Can an embedded macOS Login Item access an app.managed identity through ManagedApp APIs?

I’m developing a macOS application that contains an embedded User Service Login Item:

Outer app bundle ID: com.xxx.app

Embedded User Service bundle ID: com.xxx.app.service

Team ID: DE8Y96K9QP

The User Service is embedded at: OuterApp.app/Contents/Library/LoginItems/UserService.app

I deployed a com.apple.configuration.app.managed declaration through an MDM server, with an asset declaration of type: com.apple.asset.credential.identity, the declaration uses: "AppComposedIdentifier": "com.xxx.app (DE8Y96K9QP)"

When the ManagedApp APIs are called from the outer ZTA app, the app successfully receives the identity.

However, when the same ManagedApp APIs are called from the embedded User Service, the identity list is empty. When I instead use the embedded service’s identifier: "AppComposedIdentifier": "com.xxx.app.service (DE8Y96K9QP)", macOS reports either Error.InvalidCodeSignature or Error.NotPresent.

My questions are:

1. Can an embedded Login Item or embedded subsystem be the target of an app.managed declaration and access managed identities through ManagedAppIdentitiesProvider?
2. Or must AppComposedIdentifier always identify the top-level application that contains the embedded Login Item?
3. If the declaration targets the outer application, is there a supported way for the embedded User Service to access the same managed identity—for example, through XPC communication with the outer application?

The outer application and embedded User Service are signed by the same Team ID, and both signatures validate successfully when checked with codesign.

Thanks,

Ying