Can xcodebuild manage automatic signing?

If you open a project in Xcode 8 with "Automatically manage signing" enabled and a new bundle ID, it will automatically create and download a provisioning profile for it. But how can I get

xcodebuild

Check dependencies
No profiles for 'com.my.bundle.id' were found:  Xcode couldn't find a provisioning profile matching 'com.my.bundle.id'.
Code signing is required for product type 'Application' in SDK 'iOS 10.3'

** ARCHIVE FAILED **

The following build commands failed:
    Check dependencies
(1 failure)
Error: Error code 65 for command: xcodebuild with args: -xcconfig,/cordova-project/platforms/ios/cordova/build-debug.xcconfig,-workspace,MyApp.xcworkspace,-scheme,MyApp,-configuration,Debug,-destination,generic/platform=iOS,-archivePath,MyApp.xcarchive,archive,CONFIGURATION_BUILD_DIR=/cordova-project/platforms/ios/build/device,SHARED_PRECOMPS_DIR=/cordova-project/platforms/ios/build/sharedpch

I'm building this app using Cordova, but I don't think this is specifically a Cordova issue; I can manually run the above xcodebuild command and get the same error.

I'm using Xcode 8.3.3, and MacOS 10.12.5, with an Apple Enterprise account.

If I open the generated project in Xcode, it fixes the automatic signing, and from then on I can run the build command successfully with that bundle ID. But if I try to run it with a different bundle ID, it will fail again.

I tried using

security unlock-keychain ~/Library/Keychains/login.keychain-db

I also tried opening my private signing key in Keychain Access and setting it to "Allow all applications to access this item", without any luck.

I get the same error regardless of whether I build in debug or release mode.