Static Web App - override-pre-configured-provider (aad)

We have deployed a docusaurus documentation site (built with the React) as an Azure Static Web App. We initially set this up using the pre-configured aad provider, however this didn't allow us to restrict access to users only in our aad domain (it gave access to any MS user) .

The documentation says it is possible to do this by overriding the pre-configured (aad) provider.
We have followed the instructions on:
https://video2.skills-academy.com/en-us/azure/static-web-apps/authentication-custom?tabs=aad#override-pre-configured-provider

We set up an app registration (we are familiar with app registrations so this was straight forward)

Set up auth in our staticwebapp.config.json, (clientIdSettingName and clientSecretSettingName substituted during deployment) see below and re-deployed

   "auth": {  
       "identityProviders": {  
         "azureActiveDirectory": {  
           "registration": {  
             "openIdIssuer": "https://login.microsoftonline.com/-our tenant ID-/v2.0",  
             "clientIdSettingName": "replaced in pipeline",  
             "clientSecretSettingName": "replaced in pipeline"  
           }  
         }  
       }  
   }  

When we try to login we get 404 going to /login/aad and /.auth/login/aad
Can someone explain why this is happening.

Is there a step that we have missed?