Issue checking if user is logged into CloudKit

I've got an iOS app that is reliant on cloudkit for much of the functionality. However, I seem to be able to get in a state where the user is partially logged in. Basic cloudkit login checks pass, I can get my recordID, but I can't read or write to records like I can when I'm fully logged in.
Full details below - any ideas on how to identify this state without testing a read or write?
Upon launch of the phone, I get an 'Update Apple ID Settings' alert that states

"Some account services will not be available until you sign in again"

So, the issue is clearly related to that (which seems to be frequent with the simulator...). If I got to my settings and re-enter my password, all is well with the world. I can deal with this by error handling on an attempt to read or write, but I'd rather check in advance and warn the user appropriately.

How I check today:

At launch, I check to see if the user is logged in to cloudkit:

Code Block 
    if FileManager.default.ubiquityIdentityToken != nil {
        print("User logged in") // IT PASSES IN THIS STATE
    }
    else {
        print("User is not logged in")
    }

So far, so good. The test passes, the user is logged in. However, when I go to read or write, it is clear that I'm NOT logged in. For example, I'll get a CKErrorPermissionFailure when trying to write.

Additional note - in the current, 'partially'? logged in state, the below returns the correct recordID for my user:

Code Block 
let container = CKContainer.default()
container.fetchUserRecordID() { recordID, error in

Any ideas on how to programatically identify this partial state for cloudkit? Thanks!