Create permissions for SharePoint Site access denied when using az cli authentication

Hi all,
I ran into a problem with the msgraph provider while using az cli authentication (az login)
I used the following code to create a new site permission via the graph api for an application.

resource "msgraph_resource" "docuthek-food-permission"{
url = "sites/${data.msgraph_resource.spsite.id}/permissions"
body = {
roles = ["write"]
grantedToIdentities = [
{
application = {
id = azuread_application.app.client_id
displayName = azuread_application.app.display_name
}
}
]
}
}

Even though I had activated Global Administrator + SharePoint Admin Entra Roles for my user and also added the user as Site Administrator to the SharePoint site I was targeting, the request did return with 403.
This is the output I get:

POST https://graph.microsoft.com/v1.0/sites/<full_site_id>/permissions
│ --------------------------------------------------------------------------------
│ RESPONSE 403: 403 Forbidden
│ ERROR CODE: accessDenied
│ --------------------------------------------------------------------------------
│ {
│ "error": {
│ "code": "accessDenied",
│ "message": "Access denied",
│ "innerError": {
│ "date": ,
│ "request-id": ,
│ "client-request-id":
│ }
│ }
│ }

As soon as I switched authentication to service principal with client secret (granting Sites.FullControl.All) the creation of the permissions went through. So now I'm wonderig that maybe the wrong scopes are used to get the token in the provider code? Or at least the scope to manage SharePoint sites is missing in the token? Or is there any other way to make this work with az cli authentication?

Thanks for your help!

Start by reproducing the POST to /sites/<full_site_id>/permissions with az cli authentication, then inspect the provider code that acquires the az login token and its scopes. Compare that token with the service-principal token that succeeds; done means the missing permission is identified and fixed or the authentication limitation is clearly documented.