Docs unclear on Redirect URI when overriding built-in AAD authentication to downscope to single AAD tenant

**Describe the bug**

I'm publishing a static site, generated with Hugo. I would like my static site only visible to authenticated users in my AzureAD Tenant.
My staticwebapp.config.json is:
```json
{
"routes": [
{
"route": "/login",
"rewrite": "/.auth/login/aad"
},
{
"route": "/logout",
"rewrite": "/.auth/logout"
},
{
"route": "/.auth/login/twitter",
"statusCode": 404
},
{
"route": "/.auth/login/github",
"statusCode": 404
},
{
"route": "/*",
"allowedRoles": ["authenticated"]
}],
"responseOverrides": {
"401": {
"redirect": "/login",
"statusCode": 302
}
},
"auth": {
"identityProviders": {
"azureActiveDirectory": {
"registration": {
"openIdIssuer": "https://login.microsoftonline.com//v2.0",
"clientIdSettingName": "AAD_CLIENT_ID",
"clientSecretSettingName": "AAD_CLIENT_SECRET"
}
}
}
}
}
```

I configured an AAD Application, and put the AAD_CLIENT_ID and AAD_CLIENT_SECRET into 'Configuration' for the Static Web App. I configured a custom domain.
In the 'Registered App' configuration for 'Authentication', I configure 'ID Tokens', 'Accounts in this org directory only', and then set the Redirect URI for a 'Web' platform to `https:///.auth/login/aad/callback`.

This 'works', in that I can visit my SWA, it prompts for AAD login, and then redirects to that URL which is just an empty page.
If I use the 'built in' AAD, everything works great, but I don't want my site visible to ANY AAD user (that...seems like a silly default approach here).

Is my Redirect URI right? The documentation is extremely unclear there.

**Device info (if applicable):**
Testing on Safari and Chrome on MacOS if it matters