TokenValidationParameters validationParams = new TokenValidationParameters
{
    // We accept both the App Id URI and the AppId of this service application
    ValidAudiences = new[] { kADConfiguration_.Audience, kADConfiguration_.ClientId },

    // Supports both the Azure AD V1 and V2 endpoint
    ValidIssuers = new[] { _issuer, $"{_issuer}/v2.0" },
    ValidateIssuer = true,  // set to false and works, set to true it fails

    IssuerSigningKeys = validationInfo.Item2
};
Microsoft.IdentityModel.Tokens.SecurityToken v;
System.Security.Claims.ClaimsPrincipal answer = handler.ValidateToken(authorizationHeader.Substring(kBearer_.Length), validationParams, out v);