Getting Access Token for Microsoft Graph from asp.net core Authentication web app

I have an app which authenticates users against Azure AD as so:

Startup.cs

using Microsoft.AspNetCore.Authentication.Cookies;

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc();

    services.AddAuthentication(
        SharedOptions => SharedOptions.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme);

    services.AddAuthorization(options =>
    {
        //Auth Policies using group claims
    });
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    //loggerFactory

    app.UseCookieAuthentication();

    app.UseOpenIdConnectAtuhentication(new OpenIdConnectOptions
    {
        ClientID = Configuration["Authentication:AzureAd:ClientId"],
        Authority = Configuration["Authentication:AzureAd:AADInstance"] + Configuration["Authentication:AzureAd:TenantId"],
        CallbackPath = Configuration["Authentication:AzureAd:CallbackPath"]
    });

    //Mvc Routing
}

AccountController.cs

 [HttpGet]
 public IActionResult SignIn()
 {
     return Challenge(
         new AuthenticationProperties { RedirectUri = "/" }, OpenIdConnectDefaults.AuthenticationScheme);
 }

On controllers I want to protect I then use [Authorize(Policy = "Whatever")]

All of that is working great, so my question is does the cookie I already have contain the token I need, and if so, do I simply access it with something like User.Claims or do I need the IAuthenticationProvider set up the way it was in the example for .net 4.6 Here.

And if it's the latter how do I do so without using Owin as they have?

I should add that while Authorization is working fine, what I'd like to do now involves things like listing all users in an OU. For which, from what I can tell I'd have to access Microsoft Graph. Perhaps, I'm going in the complete wrong direction?