Setup authentication using AAD B2C for an Azure Function (ASP.Net Core 9 isolated worker model)

I'm building a web app that calls a function app, hosted in Azure. Web app users authenticate using AAD B2C. I have followed these directions to create the web app and app registrations in my B2C tenant. This is working and the web app is able to retrieve a token with the required scope. I'm also able to passes the access token as a bearer token in the authentication header of the HTTP request to the function app by using an Authorization header.

As the function app will be accessible from outside my Azure environment (e.g. from mobile app), I'm wondering how to setup the authentication on the function app side so it reads and validates the token and scope. If this was a standard web API a I could use these instructions. But since I'm using an Azure Function I'm unsure what my class should look like, and the changes to the program.cs of my Azure Function project.

Should my program.cs for the Azure Function initiate the authentication library as in:

new HostBuilder()
	.ConfigureFunctionsWebApplication()
    .ConfigureServices((context, services) =>
    {
        IConfiguration configuration = context.Configuration;
        ...
        services
            .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApi(configuration, "AzureAdB2C");
        services.AddAuthorization();
        ...
    })
    .Build()
    .Run();

I feel I'm missing something because the IHost returned by Build() doesn't have a UseAuthentication() I can call as for a WebApplication.

And should my function app (the Azure function that needs authentication) be :

using ...
...
namespace ...
{
    [Authorize]
    [RequiredScope("ReadWrite.All")]
    public class FhirProxy
    {
        ...
		
        [Function("fhir")]
        public async Task<HttpResponseData> Run(
            [HttpTrigger(AuthorizationLevel.Function, "get", "post", "put", "delete", "patch", Route = "fhir/{*path}")] HttpRequestData req)
        {
		...
		}
	}
}

Using this, although I'm able to authenticate a user and call the azure function from the web app and the resulting headers includes the Authorization token, when debugging my function, I can see that the provided identity is not authenticated (isAuthenticated == false) and does not contain any claims.

Might there exist an example of how a function app can read and validate the token and scope provided by the web app call?

I've also seen that it's possible to use a build-in authentication feature ("Easy Auth"). But this approach seems to be an all or nothing approach, and I have Azure Functions in my project that do not require authentication. I'm also unsure if this works well in the context of AAD B2C as I don't want the user to be redirected to the authentication page when the function app is called; I want the function app to read and validate the token passed from the web app (or mobile app). If this is the right approach, might there be an recent example that uses B2C?