A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)
I found the solution to this: you need to first establish a "Verified ID" in the Authenticator app. That is presumably the "card missing" that the error message is referring to.
To establish a Verified ID, follow the link under the Azure verification QR code that says "Don't have a Verified ID? Get verified here through our trusted ID-verifiers."
Here in the US, that link took me to a URL at a site called au10tix.com. From there, it took maybe 5 minutes to complete that process, including scanning in some government ID and taking a selfie.
Once done, it presented its own QR code, which the MS Authenticator app scanned to create a "Verified ID" in its wallet. Then I could double back to the QR code for Azure's identity validation, and it accepted it this time.