How can I enable Login for users on AEMaaCS?

I have a website built on AEM Sites, running in AEM as a cloud service.

I want to create a login experience for my users.  Part of the website will be public, with a handful of pages that will require login to view.  I am using Microsoft Authentication Library, which is an OAuth2 implementation of single sign on tied to azure active directory.

Once I trigger a sign in for the user and they complete the OAuth flow, what is the best way to handle session management across pages on the AEM side?  e.g., does AEM offer a native service that can 'log in' a user?  Should I just use sessions (probably won't scale)?

Any advice, pointers, or tips are welcome!