Indeed. We validate Azure AD tokens for our native application. Not all of our on-prem installations have unrestricted internet access. So we have a task that periodically checks and downloads Azure's signing keys[1], so we can distribute them to our customers.

[1]: https://login.microsoftonline.com/common/v2.0/.well-known/op... (jwks_uri element)