According to the Azure AD documentation, the Azure AD v2.0 ID Token should contain the access token hash, the at_hashclaim, when the ID token is issued with the Access Token.
However it appears that the at_hash claim is missing from the ID token. After calling the Azure AD access token request v2.0 endpoint https://login.microsoftonline.com/{my_tenant}/oauth2/v2.0/token, the id_token returned by Azure does not contain a at_hash claim although an access token is issued.
Example of response body returned by Azure AD v2.0:
"token_type": "Bearer",
"scope": "User.Read",
"expires_in": 3599,
"ext_expires_in": 0,
"access_token": "eyJ0eXAiO ...",
"refresh_token": "OAQABAAAAAAA9kTklh ..."
"id_token": "eyJ0eXAiOiJKV1QiLC ..."
The id_token contained the following claims. It did not contain the at_hash claim.
"aud": "... GUID ... ",
"iss": "https://login.microsoftonline.com/.../v2.0",
"iat": 1502324474,
"nbf": 1502324474,
"exp": 1502328374,
"aio": "ATQA ... 7liW+Hb",
"name": "... some name ... ",
"nonce": "... GUID ...",
"oid": "... GUID ...",
"preferred_username": "... some preferred name ...",
"sub": "KIuLx ... ifCaZUUi3b",
"tid": "... GUID ...",
"ver": "2.0"