[Network 2023-04-01] Network Manager issue when specifying a Management Group ID

I'm seeing an issue when trying to create a Network Manager scoped to a nested Management Group.

I'm passing in

```
{
"location": "eastus",
"name": "test",
"properties": {
"description": "network manager created through terraform",
"networkManagerScopeAccesses": ["Connectivity"],
"networkManagerScopes": {
"managementGroups": ["/providers/Microsoft.Management/managementGroups/XXX-XXX-XXX-XXXX"],
"subscriptions": []
}
},
"tags": {}
}
```

and getting back the following error

```
{
"error": {
"message": "Resource [/providers/Microsoft.Management/managementGroups/XXXX-XXXX-XXXX] is not within tenant [tenant-id]",
"code": "BadRequest"
}
}
```

That Management Group is under the specified tenant and if I go to the portal to create a Network Manager, that management group id is selectable and the network manager creates without issue.

After I do that initial creation in the portal, I am now free to create Network Managers with the specified management group.

Is there a way for the management group to be used as the network manager scope without having to first create the network manager with that scope through the portal?

Start by reviewing the Network Manager create request and its networkManagerScopes.managementGroups value in the issue, then reproduce the response for a nested management group. Compare the direct API behavior with creation through the Azure portal; done means confirming whether the API accepts the tenant-scoped management group without portal initialization or documenting the required service behavior.

Written by the indexing model from the issue text.