Azure B2C Custom Policy getting 500 Internal Server Error when trying to return alternativeSecurityIds in OutputClaims

Question

I have a User Journey that is taking a user's email address and trying to check if the user is a federated user (as a means to obfuscate the list of all Identity Providers and directly sign a user in with the desired provider). We are calling AAD-UserReadUsingEmailAddress from a custom ValidationTechnicalProfile, and returning alternativeSecurityIds in the OutputClaims. However, when clicking "Continue", there is a 500 Internal Server Error occurring to which Application Insights and B2C Audit Logs are providing no additional information. As soon as alternativeSecurityIds, the ValidationTechnicalProfile will properly execute.

Additionally, clicking the continue button causes a 500 Internal Server Error, the ValidationTechnicalProfile still seems to execute and return some of the claims, although not the alternativeSecurityIds. Those are however included in a JWT token that is returned. Screenshots of the claims from App Insights (using the B2C plugin for VS Code) and the JWT, as well as the 500 error are included.

Per the Microsoft Documentation, alternativeSecurityIds is a valid output claim.

I have seen other posts which suggest using userIdentities (a userIdentityCollection), but this does not appear to be supported by B2C, and in fact, when trying to Persist the claim, causes a 400 error with the following message: "The provided user property value is invalid. Error returned was 400/Request_BadRequest: A value without a type name was found and no expected type is available."

Is there something missing (setup, authorization) that is required in order to properly retrieve the alternativeSecurityIds?

Below are code snippets:

<ClaimsSchema>
    <ClaimType Id="alternativeSecurityIds">
        <DataType>alternativeSecurityIdCollection</DataType>
        <UserInputType>Readonly</UserInputType>
    </ClaimType>
    <ClaimType Id="identityProviders">
        <DataType>stringCollection</DataType>
    </ClaimType>
 </ClaimsSchema>

<ContentDefinition Id="api.ssosignin">
    <LoadUri>{Settings:AzureADB2CTemplateBaseUrl}sso.html</LoadUri>
    <RecoveryUri>~/common/default_page_error.html</RecoveryUri>
    <DataUri>urn:com:microsoft:aad:b2c:elements:contract:selfasserted:2.1.7</DataUri>
    <Metadata>
        <Item Key="DisplayName">SSO Sign In</Item>
    </Metadata>
    <LocalizedResourcesReferences MergeBehavior="Prepend">
        <LocalizedResourcesReference Language="en" LocalizedResourcesReferenceId="api.ssosignin.en" />
    </LocalizedResourcesReferences>
</ContentDefinition>
    
 <TechnicalProfile Id="SelfAsserted-SsoEmailLookup">
    <DisplayName>Lookup email address for SSO user</DisplayName>
    <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.SelfAssertedAttributeProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
    <Metadata>
        <Item Key="IpAddressClaimReferenceId">IpAddress</Item>
        <Item Key="ContentDefinitionReferenceId">api.ssosignin</Item>
    </Metadata>
    <CryptographicKeys>
        <Key Id="issuer_secret" StorageReferenceId="B2C_1A_TokenContainer" />
    </CryptographicKeys>
    <IncludeInSso>false</IncludeInSso>
    <InputClaims>
    <InputClaim ClaimTypeReferenceId="email" />
    </InputClaims>
    <DisplayClaims>
        <DisplayClaim ClaimTypeReferenceId="email" Required="true" />
    </DisplayClaims>
    <OutputClaims>
        <!-- Required claims -->
        <OutputClaim ClaimTypeReferenceId="objectId" />
        <!-- Optional claims -->
        <OutputClaim ClaimTypeReferenceId="userPrincipalName" />
        <OutputClaim ClaimTypeReferenceId="displayName" />
        <OutputClaim ClaimTypeReferenceId="alternativeSecurityIds" />
    </OutputClaims>
     <ValidationTechnicalProfiles>
        <ValidationTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddress-SsoUser" ContinueOnError="false" />
     </ValidationTechnicalProfiles>
     <UseTechnicalProfileForSessionManagement ReferenceId="SM-Noop" />
 </TechnicalProfile>
    
 <TechnicalProfile Id="AAD-UserReadUsingEmailAddress-SsoUser">
    <Metadata>
        <Item Key="Operation">Read</Item>
        <Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
        <Item Key="UserMessageIfClaimsPrincipalDoesNotExist">An SSO account with that email was not found.</Item>
    </Metadata>
    <OutputClaims>
        <!-- Required claims -->
        <OutputClaim ClaimTypeReferenceId="alternativeSecurityIds" />                
    </OutputClaims>
    <IncludeTechnicalProfile ReferenceId="AAD-UserReadUsingEmailAddress" />
 </TechnicalProfile>