MSI authentication is failing even though token GCM generated for the identity seems to be valid.

Version

2.4.1

Operating system

Linux

OS version or distribution

Ubuntu 20.04

Git hosting provider(s)

Azure DevOps

Other hosting provider

No response

(Azure DevOps only) What format is your remote URL?

https://dev.azure.com/{org}

Can you access the remote repository directly in the browser?

Yes, I can access the repository

Expected behavior

Be able to successfully clone the git repo.

Works - Git clone with bearer token from az login
az login --identity --username identity-client-id
az account get-access-token
Use above token for bearer authentication and git clone works.

Works - Git clone with bearer token from GCM auth log
git -c http.extraheader="AUTHORIZATION: bearer $password" clone https://dev.azure.com/msazure/one/REMOVED

Does not work - Configure GCM to use managed identity
[credential "https://dev.azure.com"]
helper =
helper = /home/aadmin/.dotnet/tools/git-credential-manager
useHttpPath = true
credentialStore = gpg
azreposManagedIdentity = id://REMOVED-CLIENT-ID
azreposCredentialType = oauth
traceSecrets = true
traceMsAuth = true
trace = /tmp/git.log
fatal: Authentication failed for 'https://dev.azure.com/mszure/one/REMOVED

So that means GCM auth is actually generating correct token for the identity, but clone is failing with auth error later?
I have attached the logs for the triage.

Actual behavior

fatal: Authentication failed for 'https://dev.azure.com/mszure/one/REMOVED

Logs

gcm-diagnose.log
git.log

Start by reviewing the attached gcm-diagnose.log and git.log, then reproduce the Azure DevOps clone using the managed-identity configuration shown in the issue. Compare the managed-identity flow with the working bearer-token cases and verify that cloning succeeds without the authentication failure.