Tenant Contributor role is insufficient for creating a Governed Workforce Tenant

I am trying to assign a minimal set of permissions needed to allow users to create Governed Workforce tenants.

I am following this document: https://learn.microsoft.com/en-us/entra/fundamentals/create-new-tenant?tabs=workforce#create-a-new-tenant-for-your-organization

However, the new built-in role "Tenant Contributor" is not sufficient for tenant creation. In the GUI, I get the message, "You do not have sufficient permissions on subscriptions. Please contact your administrator."

I tried creating a custom role with some additional permissions, but they were also insufficient:

                "actions": [
                    "Microsoft.Resources/subscriptions/read",
                    "Microsoft.Resources/subscriptions/resourcegroups/write",
                    "Microsoft.Resources/subscriptions/resourcegroups/read",
                    "Microsoft.Resources/deployments/write",
                    "Microsoft.Resources/deployments/read",
                    "Microsoft.Resources/deployments/*/read",
                    "Microsoft.Resources/deployments/validate/action",
                    "Microsoft.Resources/tags/write",
                    "Microsoft.Authorization/roleAssignments/read",
                    "Microsoft.Authorization/policyAssignments/read",

Assigning "Owner" is sufficient (when Entra-level permissions are configured correctly, of course), but I do not want to grant "Owner" to the users that need the level of access that Tenant Contributor is supposed to grant.

What minimal set of permissions do I need to get this working?

Thank you.

Update: Assigning a custom role with the following actions, which should be the equivalent of assigning the "owner" role, does not work.

                "actions": [
                    "*"
                ]