context.Authentication.User is Null in Owin WindowsAzureActiveDirectoryBearerAuthentication

I have a web api that receives requests from multiple clients and authenticates them via an Azure Active Directory tokens.

Existing apps

Existing clients are able to successfully authenticate with the API. These clients generate the tokens using an app secret. From the authentication, OwinContext has context.Authentication.User which is used in a middleware.

New application client

Now I am trying to authenticate requests from a new service, which generates tokens using a certificate. However, when trying to access the Owin Context, context.Authentication.User is null.

I have checked the Azure Active Directory JWT payload and I can see that the Tenant, Issuer and Audience is the same as the tokens generated from other apps.

This is the service authentication I have configured:

    public static class AppBuilderExtensions
    {
        public static void ConfigureServiceAuthentication(this IAppBuilder appBuilder, AppConfig appConfig)
        {
            appBuilder.UseWindowsAzureActiveDirectoryBearerAuthentication(
                new WindowsAzureActiveDirectoryBearerAuthenticationOptions
                {
                    Tenant = appConfig.AadConfig.AadTenantId,
                    TokenValidationParameters = new TokenValidationParameters
                    {
                        ValidAudiences = new []{ appConfig.AadConfig.AadApplicationId },
                        ValidIssuers = new[] { appConfig.AadConfig.AadAcceptedIssuer }
                    }
                });
        }
    }

Why is context.Authentication.User null for the token generated by this new application? How can I fix this issue?