Issues related to deleting role assignments within a locked Resource Group

[Salazander]

I'm using an Azure Blob Storage Container as Terraform Backend.
The storage account is located within a resource group that is protected against deletion using a "cannot delete" lock.
Creating Dynamic Service Principals with the Storage Blob Data Contributor role works fine.
What does not work is the removal of the role assignment when the lease expires, since the role assignment "lives" within the locked resource group.

Questions:

1. What is the general guidance on using dynamic service principals with roles scoped to resources within a locked resource group?
2. I've noticed that the Vault (v1.15.4) relentlessly attempts to remove previous role assignments - Is there a way to prevent this behavior?