Cost Management exports creation with identity type of "SystemAssigned" fails with bare 401

I am attempting to create a Cost Management export with a system-assigned managed identity (required for cross-scope delivery, since UserAssigned is explicitly rejected for this resource type), but it consistently returns a bare 401 Unauthorized with no error detail when the caller authenticates via an application token (service principal / managed identity), regardless of how much RBAC or billing-scope permission is granted. The identical request succeeds immediately when authenticated via a delegated (interactive user) token. I want to know whether this is expected/documented behavior, and if so, whether there's a supported non-interactive path (special consent flow, alternate API, specific permission) for a backend service to accomplish this.

For context, I'm using an MCA account, and attempting to set it at billing-account scope The REST endpoint I'm calling (including API version) is https://management.azure.com/providers/Microsoft.Billing/billingAccounts/{billingAccountId}/providers/Microsoft.CostManagement/exports/{exportName}?api-version=2023-11-01, with the body having identity.type: of "SystemAssigned", location: "global" and delivery destination is a storage account in a different subscription than the billing account's own scope

Every application-token attempt fails identically regardless of RBAC breadth or how the identity field is specified; the same request succeeds immediately and only via a delegated user token. (i have the correlation ids for each failure if that helps somehow)

Is there a documented or undocumented requirement that Microsoft.CostManagement/Exports creation with a SystemAssigned identity (specifically the step where Cost Management provisions and grants storage access to the new identity on the caller's behalf) requires a delegated/interactive user token, and rejects application (service principal / managed identity) tokens outright? If so, is there a supported mechanism — a specific API permission, a one-time consent flow, or an alternate API — that would let a non-interactive backend service accomplish this without requiring an interactive sign-in at the moment of export creation?