External ID credential management API refuses customer accounts with AADSTS500207

Question

We are implementing self-service passkey registration for customers per https://learn.microsoft.com/en-us/entra/identity-platform/reference-credential-management-api. Every prerequisite is in place: the API's service principal (appId 6bf38b3c-xxxx, object id ab61f646-xxxxx) is provisioned; our SPA xxx-ui (8ec22af2-xxxx) has the delegated permission Me.UserAuthenticationMethod.Passkey.ReadWrite with tenant-wide admin consent; the passkey (FIDO2) policy is enabled for all users with a default passkey profile; login.xxxx.com is a verified custom URL domain.

A local email + password customer account (creationType = LocalAccount, object id 2d755d3e-xxxx) is refused a token for this resource with AADSTS500207 "The account type can't be used for the resource you're trying to access", on xxxxid.ciamlogin.com and on our custom URL domain alike, and with the scope in both <appId>/… and api://<appId>/… form — while the same account, same session, obtains a token for our own API without issue. Trace IDs: 0b091a1f-e43d-4ba5-83df-b7e4a5570600 (2026-09-09 23:44:05Z), f40736cd-0f48-4b43-85cf-4b568fa30600 (23:45:15Z), 54b2978a-8d6f-4643-b07a-a5acc12f0600 (23:46:28Z).

Please enable the credential management API for customer accounts in our tenant (I can share all the complete IDs via private messages), or tell us which prerequisite the documentation omits.