AADSTS700226: Only MSI tokens may be used as Federated Identity Credentials for AAD issuer

Looking for guidance from Microsoft Entra ID experts. I am trying to test the following scenario:

1. Get a token from one Azure Tenant (T1) using client credential flow, but for token exchange scope. I am able to get the access token, no issue.
2. Get a token from another Azure Tenant (T2) using the token received from T1 in step (1). App is registered in T2 with Federated Credential. Federated credential is configured with issuer being T1 and subject being object id of app id from T1.
3. Use Postman to get token from T1. It works.
4. Use Postman to get token from T2. It fails.
5. My end goal is to use Federated Credential issued by Ping Federate or another issuer, but for the concept testing I am using another Azure Tenant (T1).

Question: My workload is deployed in AWS (or elsewhere) and I can't use Managed Identity since it is sitting outside Azure. Would I be able to use non AAD issuer to get a token for token exchange and use it with federated credential in T2?

Get Token from T1 for token exchange: This works fine.

Get Token from T2 using token received from T1: This is where I am getting error: AADSTS700226: Only MSI tokens may be used as Federated Identity Credentials for AAD issuer.

Note: You cannot use a client credentials token from one Azure AD tenant (T1) as a federated identity in another tenant (T2) because Microsoft Entra ID only supports MSI tokens from AAD issuers.

• To achieve token exchange from an external workload (e.g., AWS), use a non-AAD OIDC-compliant issuer (e.g., Ping Federate or AWS STS) to issue the JWT and configure it as the federated credential issuer in T2.

Hence, use an external OIDC-compliant IdP like AWS Cognito.

Create a Cognito identity for our workload:

aws cognito-identity get-open-id-token-for-developer-identity \
    --identity-pool-id <the pool id you just created>  \
    --logins <developer provider name>=<a_unique_string_identifying_your_workload> 
    --region <aws region>

Configure an Azure AD identity to trust the Amazon Cognito token:

az identity federated-credential create --name AccessFromAWS --identity-name workload-federate-MI1 \
   --resource-group codesamples-rg --issuer https://cognito-identity.amazonaws.com \
   --subject us-east-1:xxx --audience us-east-1:xxx

• Then get a Cognito token using AWS CLI.
• And login to Azure using that token.

For more in detail refer the below blog:

Azure AD workload identity federation with AWS | Identity in the cloud by uday