Insufficient privileges to complete the operation - groups with isAssignableToRole set to True

Bicep version
Run bicep --version via the Bicep CLI, az bicep version via the AZ CLI

PS: ~:bicep --version
Bicep CLI version 0.28.1 (ba1e9f8c1e)

PS: ~:az bicep version  
Bicep CLI version 0.28.1 (ba1e9f8c1e)

Resource and API version
Which Microsoft.Graph resource and API version has the issue?

Microsoft.Graph/groups@v1.0

Auth flow
Is the deployment interactive (e.g. with a signed in user) or automated (e.g. with an application)?

Both - ServicePrincipal and Signed in user

Deployment details
If it's related to deployment failures, please provide the deployment correlation id, Microsoft Graph client request id, and deployment timestamp if applicable.

{
  "status": "Failed",
  "error": {
    "code": "DeploymentFailed",
    "target": "/subscriptions/xxxx-xxxxx-xxxxx-xxxxx/providers/Microsoft.Resources/deployments/entraid-sec-groups-test",
    "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
    "details": [
      {
        "code": "",
        "message": "{\"error\":{\"code\":\"Forbidden\",\"target\":\"/resources/role_tier1Analyst\",\"message\":\"Insufficient privileges to complete the operation. Graph client request id: 9335c582-d847-49e8-9079-3e4a89a5d2e0. Graph request timestamp: 2024-06-13T11:59:32Z.\"}}"
      }
    ]
  }
}

Describe the bug

For Microsoft.Graph/groups resource type when using the property isAssignableToRole set to true, which requires an additional permission for the signed in user/service principal fails even tough the permission is granted.

From the Groups doc: https://learn.microsoft.com/en-us/graph/templates/reference/groups?view=graph-bicep-1.0

Only callers in Global Administrator and Privileged Role Administrator roles can set this property. The caller must also be assigned the RoleManagement.ReadWrite.Directory permission to set this property or update the membership of such groups.

The service principal I'm using is granted the following Microsoft Graph permissions:

• Directory.ReadWrite.All
• Group.ReadWrite.All
• RoleManagement.ReadWrite.Directory

It works fine to deploy a group without the property isAssignableToRole set to true. That would mean the permissions are in effect I would believe?

In addition to the Microsoft Graph permissions the service principal have the Entra ID role Privileged Role Administrator which is also a prerequisite.

To Reproduce

1. Create ServicePrincipal with Microsoft graph application permissions: 'RoleManagement.ReadWrite.Directory', 'Group.ReadWrite.All', 'Directory.ReadWrite.All' (Remember Global Admin consent)
2. Create a Microsoft.Graph/groups resource:

targetScope = 'subscription'

provider microsoftGraph

resource groupExample 'Microsoft.Graph/groups@v1.0' = {
  displayName: 'Example Group'
  description: 'Example Group'
  isAssignableToRole: true
  mailEnabled: false
  mailNickname: 'example-group'
  securityEnabled: true
  uniqueName: 'example-group'
}

az login --service-principal --username '1234' --password '1234' --tenant '1234'

az deployment sub create --name 'entraid-sec-groups-test' --template-file .\{filename}.bicep --location 'NorwayEast'

Additional context
Add any other context about the problem here. For example, what permissions does the identity have if it's a permission issue?