Reset Password Policy is using implicit flow by default, not authorisation code

I have an app with sign in/up and reset password, and I want it to use authorisation code flow. I do this by setting the response type to code. Here is my configuration:

"AzureAdB2C": {
    "Instance": "<instance>",
    "ClientId": <myid>,
    "ClientSecret": <secret>
    "Domain": "<domain>",
    "TenantId": <myid>
    "CallbackPath": "/signin-oidc",
    "ResponseType": "code",
    "Scope" : ["openid", "profile", <applicationid>],
    "SignUpSignInPolicyId" : "B2C_1_signupsignin1",
    "ResetPasswordPolicyId" : "B2C_1_passwordreset"
  },

The sign in flow is using authorisation code flow, however when I run the reset password flow, id_token is being added to the response type parameter (I am not sure what is adding it) and since my application does not allow implicit flow, I get the following error:

OpenIdConnectProtocolException: Message contains error: 'unauthorized_client', error_description: 'AADB2C90057: The provided application is not configured to allow the 'OAuth' Implicit flow.

My Startup code

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
                .AddMicrosoftWebApp(options =>
                {
                    Configuration.Bind("AzureAdB2C", options);
                    options.Events.OnRemoteFailure = context =>
                    {
                        context.HandleResponse();
                        if (context.Failure is OpenIdConnectProtocolException &&
                            context.Failure.Message.Contains("AADB2C90118"))
                        {
                            context.Response.Redirect("/resetPassword");
                        }
                        else
                        {
                            throw context.Failure;
                        }

                        return Task.FromResult(0);
                    };
                }, cookieOptions => { cookieOptions.ExpireTimeSpan = sessionInfo.Duration; });

and the reset password endpoint

[HttpGet("/resetPassword")]
        public IActionResult ResetPassword()
        {
            var properties = new AuthenticationProperties { RedirectUri = Url.Content("~/") };
            properties.Items["policy"] = "B2C_1_passwordreset";
            return Challenge(properties, OpenIdConnectDefaults.AuthenticationScheme);
        }

Any ideas on what is happening?

[ktsakas]

It seems like implicit flow fails, unless you select both access token and id token. Could you try this?

This will give you a run now link with id_token in it (implicit flow). I will check if this is a bug on our side.

[AshTappin]

Thanks! It is moneycorpcfxd.onmicrosoft.com