New-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleInstance fails when Authentication Context is enabled on Group

Describe the bug

I am trying to submit a new group activation request using MgGraph. The group has the setting On activation, require: Authentication context: PIM Activation configured.

I have used Get-MsalToken to acquire an access token which includes the acrs claim c1 and if I decode the token using https://jwt.ms/ I can see the acrs = c1 in the token and the auth log show that the login trigger the CA policy with the auth context.

However, when I attempt to use New-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleInstance to elevate I get the error: RoleAssignmentRequestAcrsValidationFailed

Expected behavior

The cmdlet succeeds

How to reproduce

$graph = "https://graph.microsoft.com"
$scopes = @(
    "$graph/PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup",
    "$graph/PrivilegedEligibilitySchedule.Read.AzureADGroup",
    "$graph/RoleManagementPolicy.Read.AzureADGroup"
)
$tenantId = "TENANT_ID"
$appId = "14d82eec-204b-4c2f-b7e8-296a70dab67e"

$connectionDetails = @{
    'TenantId'              = $tenantId
    'ClientId'              = $appId
    'Interactive'           = $true
    'scopes'                = $scopes
    'ExtraQueryParameters'  = @{'claims' = '%7B%22access_token%22%3A%7B%22acrs%22%3A%7B%22essential%22%3Atrue%2C%22value%22%3A%22c1%22%7D%7D%7D'}
}
Clear-MsalTokenCache
$token = Get-MsalToken @connectionDetails
Connect-MgGraph -NoWelcome -AccessToken ($token.AccessToken | ConvertTo-SecureString -AsPlainText)
$myAccount = Get-MgUser -UserId (Get-MgContext).Account
$requestParams = @{
    accessId = "member"
    principalId = $myAccount.Id
    groupId = "GROUP_ID"
    action = "selfActivate"
    scheduleInfo = @{
        startDateTime = (Get-Date)
        expiration = @{
            type = "afterDuration"
            duration = "PT1H"
        }
    }
}
New-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequest -BodyParameter $requestParams

SDK Version

2.19.0

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

</details>


### Configuration


Name                           Value
----                           -----
PSVersion                      7.4.2
PSEdition                      Core
GitCommitId                    7.4.2
OS                             Microsoft Windows 10.0.17763
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0



### Other information

_No response_

Start with the New-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequest reproduction and inspect the access token's acrs claim alongside the POST response. Compare the authentication-context request parameters with the RoleAssignmentRequestAcrsValidationFailed error; done means the self-activation request succeeds when the group requires the configured context.