Azure B2C Custom Policy getting 500 Internal Server Error when trying to return alternativeSecurityIds in OutputClaims

Question

I have a User Journey that is taking a user's email address and trying to check if the user is a federated user (as a means to obfuscate the list of all Identity Providers and directly sign a user in with the desired provider). We are calling AAD-UserReadUsingEmailAddress from a custom ValidationTechnicalProfile, and returning alternativeSecurityIds in the OutputClaims. However, when clicking "Continue", there is a 500 Internal Server Error occurring to which Application Insights and B2C Audit Logs are providing no additional information. As soon as alternativeSecurityIds, the ValidationTechnicalProfile will properly execute.

Additionally, clicking the continue button causes a 500 Internal Server Error, the ValidationTechnicalProfile still seems to execute and return some of the claims, although not the alternative SecurityIds. Those are however included in a JWT token that is returned. Screenshots of the claims from App Insights (using the B2C plugin for VS Code) and the JWT, as well as the 500 error are included.

Is there something missing (setup, authorization) that is required in order to properly retrieve the alternativeSeccurityIds?

Below are code snippets:

<ClaimsSchema>  
    <ClaimType Id="alternativeSecurityIds">  
    <DataType>alternativeSecurityIdCollection</DataType>  
    <UserInputType>Readonly</UserInputType>  
    </ClaimType>  
    <ClaimType Id="identityProviders">  
    <DataType>stringCollection</DataType>  
    </ClaimType>  
</ClaimsSchema>  
  
<TechnicalProfile Id="SelfAsserted-SsoEmailLookup">  
    <DisplayName>Lookup email address for SSO user</DisplayName>  
    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />  
    <Metadata>  
    <Item Key="IpAddressClaimReferenceId">IpAddress</Item>  
    <Item Key="ContentDefinitionReferenceId">api.ssosignin</Item>  
    </Metadata>  
    <IncludeInSso>false</IncludeInSso>  
    <InputClaims>  
    <InputClaim ClaimTypeReferenceId="email" />  
    </InputClaims>  
    <DisplayClaims>  
    <DisplayClaim ClaimTypeReferenceId="email" Required="true" />  
    </DisplayClaims>  
    <OutputClaims>  
    <!-- Required claims -->  
    <OutputClaim ClaimTypeReferenceId="objectId" />  
    <!-- Optional claims -->  
    <OutputClaim ClaimTypeReferenceId="userPrincipalName" />  
    <OutputClaim ClaimTypeReferenceId="displayName" />  
    <OutputClaim ClaimTypeReferenceId="alternativeSecurityIds" />  
</OutputClaims>  
    <ValidationTechnicalProfiles>  
    <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddress-SsoUser" ContinueOnError="false" />  
    </ValidationTechnicalProfiles>  
    <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />  
</TechnicalProfile>  
  
<TechnicalProfile Id="AAD-UserReadUsingEmailAddress-SsoUser">  
    <Metadata>  
    <Item Key="Operation">Read</Item>  
    <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>  
    <Item Key="UserMessageIfClaimsPrincipalDoesNotExist">An SSO account with that email was not found.</Item>  
    </Metadata>  
    <OutputClaims>  
        <!-- Required claims -->  
        <OutputClaim ClaimTypeReferenceId="alternativeSecurityIds" />                  
    </OutputClaims>  
    <IncludeTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddress" />  
</TechnicalProfile>