How to use an Intune-delivered SCEP certificate for mTLS in iOS app using URLSessionDelegate?

I am working on implementing mTLS authentication in my iOS app (Apple Inhouse & intune MAM managed app). The SCEP client certificate is deployed on the device via Intune MDM. When I try accessing the protected endpoint via SFSafariViewController/ASWebAuthenticationSession, the certificate picker appears and the request succeeds. However, from within my app (using URLSessionDelegate), the certificate is not found (errSecItemNotFound).

The didReceive challenge method is called, but my SCEP certificate is not found in the app. The certificate is visible under Settings > Device Management > SCEP Certificate.

1. How can I make my iOS app access and use the SCEP certificate (installed via Intune MDM) for mTLS requests?
2. Do I need a special entitlement, keychain access group, or configuration in Intune or Developer account to allow my app to use the certificate?

Here is the sample code I am using:

final class KeychainCertificateDelegate: NSObject, URLSessionDelegate {
    func urlSession(_ session: URLSession,
                    didReceive challenge: URLAuthenticationChallenge,
                    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        
        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodClientCertificate else {
            completionHandler(.performDefaultHandling, nil)
            return
        }
        
        // Get the DNs the server will accept
        guard let expectedDNs = challenge.protectionSpace.distinguishedNames else {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        
        var identityRefs: CFTypeRef? = nil
        let err = SecItemCopyMatching([
            kSecClass: kSecClassIdentity,
            kSecMatchLimit: kSecMatchLimitAll,
            kSecMatchIssuers: expectedDNs,
            kSecReturnRef: true,
        ] as NSDictionary, &identityRefs)
        
        if err != errSecSuccess {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        
        guard let identities = identityRefs as? [SecIdentity],
              let identity = identities.first
        else {
            print("Identity list is empty")
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        
        let credential = URLCredential(identity: identity, certificates: nil, persistence: .forSession)
        completionHandler(.useCredential, credential)
    }
}

func perform_mTLSRequest() {
    guard let url = URL(string: "https://sample.com/api/endpoint") else {
        return
    }
    
    var request = URLRequest(url: url)
    request.httpMethod = "POST"
    request.setValue("application/json", forHTTPHeaderField: "Accept")
    request.setValue("Bearer \(bearerToken)", forHTTPHeaderField: "Authorization")
    
    let delegate = KeychainCertificateDelegate()
    let session = URLSession(configuration: .ephemeral, delegate: delegate, delegateQueue: nil)
    
    let task = session.dataTask(with: request) { data, response, error in
        guard let httpResponse = response as? HTTPURLResponse, (200...299).contains(httpResponse.statusCode) else {
            print("Bad response")
            return
        }
        if let data = data {
            print(String(data: data, encoding: .utf8)!)
        }
    }
    task.resume()
}