Amazon Login (LWA) as Custom OpenID Connect IdP in Entra External ID — concrete config or shim required?

I'm configuring Login with Amazon (LWA) as a federated identity provider in an Entra External ID (CIAM) tenant, following the "Custom OpenID Connect provider" path. The March 2025 GA announcement (OIDC External IdP GA blog) lists Amazon as a tested and validated provider, but I cannot find any public worked configuration and the underlying protocols don't appear compatible. I'd appreciate either a confirmed-working configuration or confirmation that this path is not viable today.

Environment:

• Entra External ID tenant (External, not Workforce — confirmed Custom OIDC option appears in the admin center)
• Tenant ID: xxxxxxxx (dev/non-prod)
• Google federation via built-in Google IdP already working end-to-end in this tenant for comparison
• Goal: add Amazon as a second federated IdP via the Custom OpenID Connect provider type

The protocol mismatches I'm trying to reconcile:

No OIDC discovery document. LWA does not publish a .well-known/openid-configuration endpoint. The Custom OIDC form in the External ID admin center appears to require this — or supports manual endpoint entry, depending on which docs/threads I read. Which is it for External ID specifically (not classic B2C)?

No id_token in token response. Per LWA's Authorization Code Grant docs, the token endpoint returns {access_token, token_type, expires_in, refresh_token} — no id_token. Entra's Custom OIDC code flow expects an id_token. How does this reconcile?

No openid scope. LWA only offers profile, profile:user_id, postal_code. There is no openid scope to request.

Userinfo claim shape is non-OIDC. LWA's /user/profile endpoint returns {user_id, email, name, postal_code} — not the standard OIDC sub/email/email_verified/name.

What I'm specifically asking:

(a) Is there a documented or supported configuration in Entra External ID's "Custom OpenID Connect provider" form that wires LWA end-to-end? If yes, please share the exact form values (Issuer URL, Authorization endpoint, Token endpoint, Userinfo endpoint, Scope, Response type, Client authentication method, JWKS URL, Claims mapping).

(b) If the form saves but runtime federation fails on the missing id_token, is there a known workaround inside Entra (e.g., a "userinfo-only" mode, or a way to instruct Entra to skip id_token validation)?

(c) If the answer to (a) and (b) is "no, it's not actually supported despite the GA blog wording" — could the docs be updated to clarify which of the listed providers truly require zero shim and which need an OIDC adapter?

(d) For B2C the historical path was a custom policy with Protocol Name="OAuth2". Is there an External ID equivalent (custom auth extension, custom protocol provider) that could wrap LWA's OAuth2 endpoints?

What I'm NOT looking for:

• A pointer back to the GA blog (already read; the "validated" claim is what I'm trying to verify)
• A pointer to the classic B2C Amazon docs (different platform; the custom-policy XML option doesn't exist in External ID)
• Suggestions to use Google federation instead (already done; Amazon is a deliberate second-IdP add)

Happy to provide test results from attempting the configuration if that would help. Thanks for any direct or indirect confirmation.