What is the behaviour when publishing a single-tenant Open ID Connect application to the EntraID Gallery?

I've gone through the exercise of creating a multitenant enterprise application using OIDC on EntraID, and I understand the behaviour. Whilst, I haven't gone through the process of publishing it to the gallery, I know what the behaviour in the customer's tenant will be, and what they have to configure as I can test this via using the consent URL. I see that the user in the customer's tenant has no control at all over the app registration where I define the redirect URLs, tokens to issue, app-roles, etc.

However, I do not know what the behaviour would be if I were to publish a single-tenant Open ID Connect application, as listed here, where the documentation reads

If your application requires additional per-instance configuration, such as customers needing to control their own secrets and certificates, you can publish a single-tenant Open ID Connect application.

What is the difference between this approach and allowing a user to create their own app registration and enterprise application? What is configurable and what is not?

In my case, I'm interested in allowing the customer to define their own roles, but preferably not their own redirect URLs or what goes in the tokens, etc.

Is there anywhere I can test this behaviour? I'm assuming that some things are not allowed to be controlled by the customer user, e.g. documentation links, terms of service URLs, etc. But I can't see this documented anywhere so I'm going in blind.

I'm the product manager that worked on the single tenant OIDC gallery feature.

When publishing into the gallery, you are able to pre-populate information such as reply URIs, terms of service links, needed permissions, etc.. You can think of this as a step you take to help simplify the onboarding process for your customers -- instead of a multi-step process for them, you've prefilled information that they no longer need to configure themselves, and they can get all that goodness with a click of a button.

In its current state, the customer will get full control of the app registration and service principal that will be instantiated within their tenant. This information could be changed by the customer (i.e. there is no block preventing them from doing so) so keep that in mind.

Hope this helps!

Erin