Service Principal Creation is throwing error - ##[error][Authorization_RequestDenied] : When using this permission, the backing application of the service principal being created must in the local tenant

### Description

Hi Team,

We started getting the error message – **##[error][Authorization_RequestDenied] : When using this permission, the backing application of the service principal being created must in the local tenant** with New-AzADServicePrincipal where an App Registration gets created, but the corresponding Enterprise Application is never created and throwing the above error. We found this issue is happening intermittently with workload federated identity.

We are using AzurePowershell@5 ADO task which internally calls powershell script to create service principal and app registration with the below command

New-AzADServicePrincipal -ApplicationId $($app.AppId)

Above command was intermittently failing. Please help us to resolve this issue

### Issue script & Debug output

```PowerShell
New-AzADServicePrincipal -ApplicationId $($app.AppId)

Headers:
x-ms-client-request-id :
CommandName : Az.MSGraph.internal\New-AzADServicePrincipal
FullCommandName : New-AzADServicePrincipal_CreateExpanded
ParameterSetName : __AllParameterSets
User-Agent : AzurePowershell/v15.3.0,PSVersion/v7.5.4,Az.MSGraph/9.0.0,ADO_AzurePowerShell_v5_Windows_NT_ado-admin-prod-aveva-vsts-vsdlp-c6mwl_spcreationerror_7957932__

Body:
{
"appId": ""
}

DEBUG: BeforeCall:
DEBUG: 5:22:32 PM - [ConfigManager] Got nothing from [DisableInstanceDiscovery], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
Forbidden

Headers:
Cache-Control : no-cache
Transfer-Encoding : chunked
Strict-Transport-Security : max-age=31536000
request-id :
client-request-id :
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"West US 2","Slice":"E","Ring":"4","ScaleUnit":"001","RoleInstance":"RoleInstance"}}
x-ms-resource-unit : 1
Date : Thu, 07 May 2026 17:22:32 GMT

Body:
{
"error": {
"code": "Authorization_RequestDenied",
"message": "When using this permission, the backing application of the service principal being created must in the local tenant",
"innerError": {
"date": "2026-05-07T17:22:33",
"request-id": "",
"client-request-id": ""
}
}
}
```

### Environment data

```PowerShell
==============================================================================
Task : Azure PowerShell
Description : Run a PowerShell script within an Azure environment
Version : 5.272.7
Author : Microsoft Corporation
Help : https://aka.ms/azurepowershelltroubleshooting
==============================================================================
```

### Module versions

```PowerShell
"C:\Program Files\PowerShell\7\pwsh.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command ". 'C:\azp\agent\_work\_temp\cd7f7e3c-4123-4758-bc61-37e36d5093fa.ps1'"
Added TLS 1.2 in session.
Import-Module -Name C:\Program Files\WindowsPowerShell\Modules\Az.Accounts\5.3.2\Az.Accounts.psd1 -Global
Update-AzConfig -CheckForUpgrade False -AppliesTo Az -Scope Process
```

### Error output

```PowerShell

```