Cognito Federated Identity authentication failure: Issuer doesn't match providerName

Hi, Cognito (Identity Pool, not user pool) is using an OIDC Identity Provider representing Azure AD, with ProviderName = "sts.windows.net/{tenantID}/". My app obtains an Azure AD token with issuer = "https://sts.windows.net/{tenantID}/". I'm getting the above error.

I can't edit the AWS IAM provider name or the issuer in the Azure AD token, so I'm stuck. However, when my app uses the same Azure AD token (i.e. same issuer) to exchange the Azure AD token via STS (not Cognito) using the exact same OIDC Identity Provider (as seen in AWS IAM), it works fine.

Any ideas? Thank you.