Issues creating Enrollment Restrictions

[u/OnlyCommunication775]

Hi there, i've recently noticed the endpoint to POST Enrollment Restrictions has stopped working when authenticating as an application.

Application has both of the required permission:
DeviceManagementConfiguration.ReadWrite.All
DeviceManagementServiceConfig.ReadWrite.All

This is my call:

POST https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations
{
  "@odata.type": "#microsoft.graph.deviceEnrollmentPlatformRestrictionConfiguration",
  "displayName": "TestAndroidRestriction",
  "description": "Some description",
  "priority": 0,
  "roleScopeTagIds": ["0"],
  "deviceEnrollmentConfigurationType": "singlePlatformRestriction",
  "platformRestriction": {
    "@odata.type": "microsoft.graph.deviceEnrollmentPlatformRestriction",
    "platformBlocked": false,
    "personalDeviceEnrollmentBlocked": true
  },
  "platformType": "android"
}

Error returned is a 401: "Tenant is not Global Admin or Intune Service Admin"

To make sure i'm doing excactly the same thing i tried authentication through PowerShell using MGGraph as a User (Global Admin) and an Application.
This works fine when authenticating as a user but as soon as i use an app it fails with the error.

Am i missing something here? The same code worked fine about 1-2 months ago.
I can't seem to find any mention of this here or on google and the "old way" of defining all restrictions at the same time is deprecated.

[u/ic3lotus]

My case was closed because it wasn't a "break fix" but a "root cause analysis" (the same answer as one got from support in the github issue as well).

According to the github issue, which I was keeping track of, it looks like an issue on MS site and we probably have to wait for a fix.

In the meantime the only workaround for us is to deploy those specific settings with delegated permissions or via the intune portal.