Unable to onboard Sentinel workspace from Lighthouse to Defender

I got the following error "Failed to log-lighthouse workspace. Try again later." when I tried to connect a customer's Microsoft Sentinel workspace to Microsoft Defender XDR.

This is to migrate Microsoft Sentinel in the Azure portal to the Defender portal as after March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal, from here.

From the onboarding prerequisites here, I have the following permissions:

In my tenant:

• (Entra) Security Administrator

Customer's resource group defined in the Lighthouse ARM template:

• (Azure) User Access Administrator
• (Azure) Contributor
• (Azure) Microsoft Sentinel Contributor

Here is what I've tried:

• Switching the Lighthouse ARM template from RG scope to Subscription scope
• Create a new Log Analytics Workspace and add Microsoft Sentinel to a workspace (instead of using the one created by the customer)

Taken from the onboarding prerequisites link:

If you're working with multiple tenants, note that granular delegated admin privileges (GDAP) with Azure Lighthouse isn't supported for Microsoft Sentinel data in the Defender portal.

Correct me if I'm wrong, but my setup does not use GDAP.

If possible, I would want to avoid using B2B as my company has been using Azure Lighthouse to manage our customers' Sentinel resources.

Happy to hear any answers!