Using it with version 10.11.x (Docker) for more than half a year.
Had to omit the trailing slash for xwiki.home (contrary to the documentation in xwiki.cfg).
I followed the OpenID Connect Authenticator documentation:
Had to put the values (endpoints, client identifier, secret, …) from AzureAD into xwiki.properties and removed the “issuer.host” from oidc.user.nameFormater (superfluous with only one host), but left most of it unchanged. Then activated it in xwiki.cfg.
The authentication could be tested well with a localhost installation, so there was no need to set up a public instance for testing purposes. The problem with the trailing slash did not appear until the public domain was used (but that might be server/tomcat specific).