AADSTS500207 calling the new credential management API (Me-CredentialProfileManagement) with an External ID (CIAM) local account

We're trying to use the new preview credential management API (https://learn.microsoft.com/en-us/entra/identity-platform/reference-credential-management-api) to self-service register a passkey for a signed-in customer in a Microsoft Entra External ID (CIAM) tenant, as documented in the "Sign in with passkeys" guide's Step 3 (which now recommends this API over the fido2AuthenticationMethod Graph API for customer self-service).

Setup:

• Tenant: OnMed-Externalid-Dev (External ID/CIAM tenant), tenant ID d57fe493-e725-4a91-8ba2-babd6a783654, subdomain devpatientportal.
• Provisioned the credential management API's service principal per the docs (POST /servicePrincipals { appId: "6bf38b3c-a70f-49aa-a1d9-10e4cc74dde9" }) — succeeded, display name Me-CredentialProfileManagement.
• Added the delegated permission Me.UserAuthenticationMethod.Passkey.ReadWrite to our client app registration and granted tenant admin consent — confirmed granted in the portal.
• Client acquires a token via MSAL.js (acquireTokenSilent, falling back to acquireTokenPopup) for scope api://6bf38b3c-a70f-49aa-a1d9-10e4cc74dde9/Me.UserAuthenticationMethod.Passkey.ReadWrite, using both the tenant's default authority and an explicit tenant-specific https://devpatientportal.ciamlogin.com/{tenantId}/v2.0 authority (same result either way).

Result: Every token acquisition attempt fails with:

AADSTS500207: The account type can't be used for the resource you're trying to access.
Trace ID: d696012e-1a10-4ca6-98a4-651155a80900
Correlation ID: 01a03342-135a-7e7f-86a5-82e4f51e8de4
Timestamp: 2026-08-24 10:12:43Z

This happens for a standard External ID local account (email + password), created directly in this tenant — not a personal Microsoft account or a workforce/guest account.

What we've ruled out: The commonly-documented fix for this error is setting the resource's app registration to single-tenant (Supported account types). We inspected Me-CredentialProfileManagement's service principal directly via Graph and found signInAudience: "AzureADandPersonalMicrosoftAccount", owned by Microsoft (appOwnerOrganizationId is not our tenant) — we have no ability to reconfigure it, and it's not documented as something we're expected to.

Question: Is this a known current limitation of the credential management API for External ID (CIAM) local accounts, or is there an additional tenant/app configuration step we're missing? The feature is explicitly documented as the recommended path for customer self-service passkey registration in External ID, so we'd like to understand whether this is expected to work today.