Disabling "Target specific AAGUIDs" in FIDO2 settings causes passkey authentication to fail

We've had both Authenticator and Yubikey passkeys working well for over a year for all users. We've had the "Target specific AAGUIDs" setting enabled, because it seemed like a good idea at the time. I now wanted to disable it to allow any passkey model to be used, and when I did I got logged out and couldn't sign in again. I had to use a break-glass account with a password to sign in. The passkey (a Yubikey) for that account didn't work.

The sign-in log entry for the failed authentication shows "FIDO sign-in is disabled via policy", while FIDO2 is enabled in authentication methods. The passkey profile has the following settings:

Enforce attestation: no
Passkey types: Device-bound, Synced
Target specific AAGUIDs: yes (this is the one I want uncheck / set to no)
Behavior: Allow

Re-enabling the Target specific AAGUIDs" instantly caused passkey authentication to work again.

This suggests either:

1. A bug in the current passkey profile implementation.
2. An undocumented dependency where a passkey profile requires at least one provider/model definition to remain valid.
3. A policy configuration issue elsewhere that's only exposed when the AAGUID targeting setting is disabled.

That botha regular user and an emergency access user both had the same "FIDO sign-in is disabled via policy" error points me to a tenant-wide policy evaluation issue and not a problem with the passkeys.

Has anybody seen this, or have any ideas about what can have caused it?