Azure Automation with System Managed Identity and Request-PnPPersonalSite

[Deas-h]

Hello,

I followed https://pnp.github.io/powershell/articles/azureautomationrunbook.html to create the automation account with a system managed identity. Then I gave the managed identity - hopefully - all required permissions:

Microsoft Graph
[Group.Read.All]
[User.Read.All]

Office 365 SharePoint Online
User.ReadWrite.All
[TermStore.ReadWrite.All]
[Sites.FullControl.All]

Then I created a script to get all users without a personal site and create one for them. The group is used to get only users with a SharePoint license:

Get-PnPAzureADGroupMember -Identity "xxx" | ForEach-Object {
$Mail = $.Email
If ((Get-PnPTenantSite -IncludeOneDriveSites -Filter "Url -like '/personal/'" | Where-Object {$.Owner -eq $Mail}).count -eq 0) {
Write-Output $Mail
Request-PnPPersonalSite -UserEmails $Mail
}
}

The script works so far that I get the Write-Output of the missing users, but the Request-PnPPersonalSite only throws this error:

"Attempted to perform an unauthorized operation."

Am I doing aynthing wrong, or are there any permissions missing?

Thanks a lot for your help!