APIM Developer Portal — Entra ID token issued successfully, but /users call fails with 401 (scheme_not_supported)

User navigates to https://developer-portal.gcfund.org/ and lands on the Sign in page.
User clicks the "Microsoft Entra ID" button (the SSO widget shown on the sign-in form).
Browser redirects to the Microsoft login page; user authenticates with their Entra ID credentials (or is already signed in and passes through silently).
Browser redirects back to the Developer Portal — the token itself appears to be issued successfully at this stage (we can see it being returned from the /token and /openid-configuration calls in the browser dev tools).
However, right after that, the portal makes a POST request to https://apim-gcf-koreacentral.data.azure-api.net/users?api-version=2022-04-01-preview — this fails immediately with 401 Unauthorized, and the response includes WWW-Authenticate: AAD realm="" error="scheme_not_supported".
Because the response body is empty, the portal's frontend throws SyntaxError: Unexpected end of JSON input while trying to parse it, and the user is left on the sign-in page with this error banner instead of being signed in.
So the failure point seems to be after the Entra ID token is obtained, at the point where the Developer Portal tries to use that token to call APIM's /users endpoint. We've also confirmed that the client secret on our Entra App Registration is not close to expiry, so we don't believe this is a simple credential expiration issue.

Reproduce the sign-in flow at https://developer-portal.gcfund.org/ and inspect the browser requests to /token, /openid-configuration, and the APIM /users endpoint. Start with the 401 response and its WWW-Authenticate scheme_not_supported error, then trace how the returned Entra ID token is used by the portal. Done means Entra ID sign-in completes without the /users 401 or the frontend JSON parsing error.

Written by the indexing model from the issue text.