I have a TechnicalProfile like this:

<TechnicalProfile Id="ExternalDirectorySignInProfile">
    <DisplayName>Multi-Tenant AAD</DisplayName>
    <Protocol Name="OpenIdConnect" />
    <Metadata>
        <Item Key="METADATA">https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration</Item>
        <!-- enable sign in from specific token issuers (v2.0) -->
        <Item Key="ValidTokenIssuerPrefixes">{Claim:tokenIssuerPrefix}</Item>
        ... blah ...
    </Metadata>
    ... blah ...
</TechnicalProfile>

So I’m trying to use a Claim Resolver: {Claim:tokenIssuerPrefix} and it’s having none of it:

The ValidTokenIssuerPrefixes metadata item in technical profile 'ExternalDirectorySignInProfile' of policy 'B2C_1A_TrustFrameworkExtensions_Debug' does not contain a list of comma delimited URIs

To be fair the docs only mention Claim Resolvers working “in an input or output claim”.

In a previous OrchestrationStep in my policy I have called a REST service that has determined whether the user’s domain name is recognised for multi-tenant AAD sign-in and has returned their tokenIssuerPrefix as a claim and I want to restrict the tenants that we’ll accept authentication from to just that tokenIssuer. If there’s another way, then please do tell me, otherwise I’ll just have to open it to all AAD tenants