Microsoft Defender for Mobile app on Android doesn't allow to login when Require app protection policy is required

I'm configuring a tiny Intune tenant and have enforced the default policy to either "Require an approved app" or "Require app protection policy" in Conditional Policies.

In Intune, there is an app protection policy that applies to all applications.

So far, so good.

So I have approved Defender App, set it to required by all users and made it a part of compliance policy for Android.

What happens on my Xperia 1 VI is (either during enrollment or in existing profile), Defender is prompting to select a user and requires to authenticate. After authenticating successfully, I get the following message:

You can't get there from here.

It looks like you're trying to open this resource with an app that hasn't been approved by your IT department...

Despite the following article, claiming this (the app ID in the troubleshooting details of the error message is exactly as in the article below):

You can use the Microsoft Defender for Endpoint app with the approved client app policy in Intune to set the device compliance policy to Conditional Access policies. There's no exclusion required for the Microsoft Defender for Endpoint app while you're setting up Conditional Access. Although Microsoft Defender for Endpoint on Android and iOS (app ID dd47d17a-3194-4d86-bfd5-c6ae6f5651e3) isn't an approved app, it has permission to report device security posture. This permission enables the flow of compliance information to Conditional Access.

Grant controls in Conditional Access policy - Microsoft Entra ID | Microsoft Learn

If I disable "Require an approved app" condition in the Conditional Access policy, I get the following message:

You can't get there from here.

It looks like you're trying to open this resource with a client app that is not available for use with app protection policies...

I cannot make exceptions for Defender app, as it doesn't show up in the list of the applications listed in Conditional Access Policy. Not even with Microsoft Graph - it doesn't allow to add well-known ID of the Defender App, complains it is invalid application.

So is there any chance to sign-in to Defender on Android, while requiring approved app or app protection policy?