401 UnauthorizedAccess when calling STIX Threat Intelligence Upload API

We are calling the Threat Intelligence Upload API (Preview) using a registered Microsoft Entra app.

We’ve followed all required steps:

App is registered in Entra ID with correct permissions

client_credentials flow is used with scope https://management.azure.com/.default

We use the correct workspace customerId in the endpoint

Service principal (objectId: dd1f988d-...) has Microsoft Sentinel Contributor role assigned directly at the Log Analytics workspace level (workspaceId: 5ea9fd94-...)

We also tried assigning Log Analytics Contributor and adding Directory.Read.All to rule out any backend validation issues

We receive a valid access token with aud: https://management.azure.com

We get consistent 401 UnauthorizedAccess errors with this message:

{
  "code": "UnauthorizedAccess",
  "message": "The Object ID [dd1f988d-...] does not have required permission to perform this action on the workspace [5ea9fd94-...]"
}

We have tested this with a minimal payload as shown in Microsoft’s documentation, using valid STIX format. The token's claims show the correct oid, appid, and aud.

Please investigate whether this is an API-side permission validation issue or a backend propagation failure, as all known documented steps have been followed.