Stumbled across this question when facing the same issue. In my case the problem was that I was hooking into the events on the configureMicrosoftIdentityOptions delegate (commented out below) when I should have been using the configureJwtBearerOptions delegate (first argument below);

authBuilder.AddMicrosoftIdentityWebApi(
    jwtOptions =>
    {
        jwtOptions.Audience = clientId;
        jwtOptions.EventsType = typeof(MyAuthenticationEvents);
    },
    identityOptions =>
    {
        identityOptions.Instance = "https://login.microsoftonline.com/";
        identityOptions.ClientId = clientId;
        identityOptions.Domain = tenantId;
        identityOptions.TenantId = tenantId;
        //identityOptions.EventsType = typeof(MyAuthenticationEvents);
    },
    jwtBearerScheme: AuthenticationSchemes.Admin);