Version 2.0.5 seems to include a breaking change
The changelog for 2.0.5 reads "BREAKING: Microsoft's id_token is no longer left as access_token['id_token'], but moved to the standard access_token.token that all other strategies use". Since this is a breaking change it seems the major version number should have been bumped. I'm reporting this bug as per the versioning section in the README.