This is ADFS 4.0 (Server 2016) and you need the official release.
I tried to get this working on the TPx series but no joy.
I kept getting the error:
"MSIS9358: Received invalid OAuth authorization request. The authorization server does not support the response type 'token' for confidential clients."
However, there is an extra entry in the official release which seems to to the job.
When you select this entry, you first get to configure a "Native Application" that generates a ClientID and you need to provide a "Redirect URI" and then an "Access Policy".
You end up with something like:
and you can configure the web application with claims etc.
The "Native Application" seems a bit weird but refer Customizing Id_Token Claims with OpenId Connect in AD FS 2016.
"Behind the scenes, this template creates a native client and new app
type called Web application, which is just a Web API with an Identifier
(RPID) that matches the native client's client ID. This means the Web
application is simultaneously client and resource, so you can assign
issuance transform rules as you would with a Web API."
As always, the gist is here.
If you look at the access token with e.g. jwt.io, you see:
Notice the "apptype" is "Public" and this is what is required for this flow. Hence the error about "confidential clients".