We use BrainCloud External Authentication (AuthenticateExternal) as our primary auth method.
We do not use AuthenticateAnonymous at all.

Our flow is:

1. Client calls our own backend server with a device identifier (SystemInfo.deviceUniqueIdentifier)
2. Our server creates/finds an account in our own identity provider using a deterministic anonymous ID derived from the device identifier
3. Our server then calls BrainCloud S2S API (SYS_CREATE_USER_EXTERNAL_AUTH) to create a BrainCloud profile before returning a response to the client
4. Our server returns a user ID and access token to the client
5. The client then calls AuthenticateExternal(userId, accessToken, externalAuthName, forceCreate: true)

The relevant server-side code (Step 3):

public async Task<AccountData> EnsureExternalAccountAsync(string externalId)
{
    var account = await BrainCloudS2SClient.CallAsync<AccountData>(
        "friend", "GET_PROFILE_INFO_FOR_EXTERNAL_AUTH_ID_IF_EXISTS", ...);

    if (string.IsNullOrEmpty(account.BrainCloudProfileId))
    {
        account = await BrainCloudS2SClient.CallAsync<AccountData>(
            "user", "SYS_CREATE_USER_EXTERNAL_AUTH", ...);
    }

    return account;
}

The Problem

Since launch, zero users are counted as New Users in the BrainCloud dashboard.
Every user appears as a Returning User.

Questions

Q1. When AuthenticateExternal is called and the profile already exists (created earlier via SYS_CREATE_USER_EXTERNAL_AUTH S2S), does BrainCloud return "newUser": "false" — even if the user has never called AuthenticateExternal before?

Q2. Does BrainCloud's New User analytics (retention cohorts, DAU new/returning breakdown) rely on the newUser flag from AuthenticateExternal, on the profile's createdAt timestamp, or something else?

Q3. If the S2S pre-creation is the cause, what is the recommended pattern?

• Should we remove the S2S pre-creation and let AuthenticateExternal(forceCreate: true) be the sole profile creator?
• Or is there a way to mark an S2S-created profile so BrainCloud still counts the first AuthenticateExternal call as a New User event?