TL;DR
Use the CosmosDBManagementClient (control plane), not the CosmosClient (data plane) when creating a Cosmos DB container with a vector embedding and authenticating with Entra ID. Key-based authentication works just fine with the CosmosClient. Hopefully, Microsoft will fix this soon. In the meantime, hopefully, this saves someone some time.