Provider sign-in required

Credential status is loaded only from the tenant-scoped API.