Implement SSO for two separate websites and Azure Functions app using Microsoft Active Directory (Azure AD)

We have 2 standalone websites (one is written on ASP.NET Core 3.1, another one is written on ASP.NET Framework 4.7) and an Azure Functions app used as an API. Currently we storing users data in Azure Cosmos DB and using ASP.NET Identity Core framework with help of [login to view URL] package to interact with it. Beside roles, users can also have individual custom claims. We would like to implement SSO for both websites and Functions using AD. We'd like to cover the following scenarios: Scenario 1 1) User authorizes on one of the websites and gets access to some pages. 2) User clicks a button. A request goes to the Web app. 3) Web app checks authorization and sends a request to Functions app. 4) Functions app checks authorization and performs some operation. Scenario 2 1) User authorizes on one of the websites and gets access to some pages. 2) User clicks a button. A request goes directly to Functions app. 3) Functions app checks authorization and performs some operation.