This message was deleted.

The root management group requires special elevated permissions for interaction. My guess is you trying to create a management group under root. Do you get the same problem if you target none root management group and permissions assigned there? I will try and run a test tomorrow and see if my theory accurate.

What RBAC role does the serviceprincipal need. I'm trying to create the management group under a sub-management group.,

This where things gets weird. I also had to be on user access for sub management groups. I also couldn't enable hierarchical permissions with user access enabled. Provisioning manually through the portal works fine without user access. I missing something or something broke. I would pop a Microsoft ticket and see if they can provide any insight.