System.UnauthorizedAccessException when creating communication site with hubsite association using delgated permissions

Hi all, we are using PnP framework to create communication sites and link them to the root hub site. System account and delegated app permissions (specific AAD user with ROPC auth flow / selected.sites is not an option here).

After deploying the solution to the production environment, we got System.UnauthorizedAccessException: Attempted to perform an unauthorized operation during the create site call. After some investigation, we confirmed that we get this error ONLY when using the HubSiteId parameter in the creation call even with the SharePoint admin account. It's also straightforward to replicate from PnP PowerShell (which makes the same call as our backend internally):

This works fine:
New-PnPSite -Type CommunicationSite -Title xxx -Url https://xxxx.sharepoint.com/sites/xxxx

This will fail:
New-PnPSite -Type CommunicationSite -Title xxx -Url https://xxxx.sharepoint.com/sites/xxxx -HubSiteId 'xxxxxxx-4536-4270-814c-fb6bc6cb1c05'

Error response (using pnp powershell):
New-PnPSite: {"error":{"code":"-2147024891, System.UnauthorizedAccessException","message":"Attempted to perform an unauthorized operation."}}

The same configuration was performed in all 3 tenants (delegated permissions, system account has hub association permissions, site collection admin on the hub,....). The only relevant difference between production and other environments is that the system account is a local AD user synchronized to the AAD. We are working to discard this as the source of the issue.

Also, we found a very similar issue in pnpjs:
https://github.com/pnp/pnpjs/issues/2317

We are investigating if the _api/GroupSiteManager/CreateGroupEx API is changing to _api/SPSiteManager/create for communication sites or something like that.

Any help is appreciated.

The failure is reproduced with New-PnPSite when HubSiteId is supplied, while the call without it succeeds. Compare the _api/GroupSiteManager/CreateGroupEx and _api/SPSiteManager/create entry points, and review the related pnpjs issue 2317 first. Done means identifying the delegated-permission cause and documenting or fixing the failing authorization path.