Unable to create Storage Sync Cloud Endpoint (MgmtStorageAccountAuthorizationFailed), even though account has Owner role assigned

When trying to create a Storage Sync Cloud Endpoint, I am getting error code MgmtStorageAccountAuthorizationFailed. The account being used to run the TF code & the Storage Sync Service both have Owner role assigned on the Storage Account

"error":{"code":"MgmtStorageAccountAuthorizationFailed","message":"Unable to read specified storage account. Please check the permissions and try again after some time."}

Full Error:

resource "azurerm_storage_sync_cloud_endpoint" "ena_secure" {
  name                  = "Citrix-File-Sync-Cloud-Endpoint-${var.environment.short}-ENA-Secure"
  storage_sync_group_id = azurerm_storage_sync_group.ena.id
  file_share_name       = module.ena_secure_file_storage[0].upm_share_name
  storage_account_id    = module.ena_secure_file_storage[0].storage_account_id
  depends_on            = [null_resource.ena_secure] # adds role to Storage Account
}

Related to this question

Unable to create Storage Sync Cloud Endpoint (MgmtStorageAccountAuthorizationFailed), even though account has Owner role assigned

According to this MS-Document,

When using a managed identity with Azure File Sync:

• The Storage Sync Service managed identity needs Storage Account Contributor role on the storage account.
• It also needs Storage File Data Privileged Contributor role on the Azure file share.

According to this Document

Azure File Sync has access to your Storage Account, assign the Reader and Data Access role to Microsoft.StorageSync on the storage account (service principal)

Code:

provider "azurerm" {
  features {}
  subscription_id = "xxxx"
}

provider "azuread" {
  # Use default config, authenticates via az login or environment
}

variable "environment" {
  default = {
    short = "prod"
  }
}

variable "azurerm_vars" {
  default = {
    azurerm_location       = "eastus"
    azurerm_resource_group = "xxxxx"
  }
}

# Resource Group
resource "azurerm_resource_group" "main" {
  name     = var.azurerm_vars.azurerm_resource_group
  location = var.azurerm_vars.azurerm_location
}

# Storage Account
resource "azurerm_storage_account" "my_storage" {
  name                     = "mystorage${var.environment.short}"
  resource_group_name      = azurerm_resource_group.main.name

  location                 = azurerm_resource_group.main.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

# File Share
resource "azurerm_storage_share" "my_share" {
  name                 = "fileshare${var.environment.short}"
  storage_account_id = azurerm_storage_account.my_storage.id
  quota                = 50
  acl {
    id = "GhostedRecall"
    access_policy {
      permissions = "r"
    }
  }
}
# Storage Sync Service (without managed identity)
resource "azurerm_storage_sync" "ena_sync" {
  name                = "Citrix-File-Sync-${var.environment.short}"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
}

# Lookup existing Azure AD app Microsoft.StorageSync
data "azuread_service_principal" "storage_sync_app" {
  display_name = "Microsoft.StorageSync"
}

# Assign Reader and Data Access role to the Microsoft.StorageSync app on your Storage Account
resource "azurerm_role_assignment" "assign_reader_and_data_access" {
  principal_id         = data.azuread_service_principal.storage_sync_app.object_id
  role_definition_name = "Reader and Data Access"
  scope                = azurerm_storage_account.my_storage.id

  depends_on = [azurerm_storage_account.my_storage]
}

# Wait to allow role assignment to propagate
resource "time_sleep" "wait_for_rbac" {
  depends_on      = [azurerm_role_assignment.assign_reader_and_data_access]
  create_duration = "60s"
}

# Storage Sync Group
resource "azurerm_storage_sync_group" "sync_group" {
  name            = "sync-group-${var.environment.short}"
  storage_sync_id = azurerm_storage_sync.ena_sync.id
}

# Storage Sync Cloud Endpoint
resource "azurerm_storage_sync_cloud_endpoint" "cloud_endpoint" {
  name                  = "cloud-endpoint-${var.environment.short}"
  storage_sync_group_id = azurerm_storage_sync_group.sync_group.id
  file_share_name       = azurerm_storage_share.my_share.name
  storage_account_id    = azurerm_storage_account.my_storage.id

  depends_on = [time_sleep.wait_for_rbac]
}

Output:

azurerm_storage_sync_cloud_endpoint.cloud_endpoint: Creation complete after 26s [id=/subscriptions/xxxxx/resourceGroups/xxg/providers/Microsoft.StorageSync/storageSyncServices/Citrix-File-Sync-prod/syncGroups/sync-group-prod/cloudEndpoints/cloud-endpoint-prod]

Apply complete! Resources: 8 added, 0 changed, 1 destroyed.

Portal: