az ad sp create-for-rbac intermittent triggers error "When using this permission, the backing application of the service principal being created must in the local tenant"

[TonySh127-ms]

This CLI command "az ad sp create-for-rbac" will intermittent triggers below error:
Error: When using this permission, the backing application of the service principal being created must in the local tenant
requestId:3896deac-4831-4503-a21b-eab9b467ca4f
Date: 2021-06-22T02:06:54

Troubleshooting:

• We check the normal scenario, there are 2 requests which sent to “https://graph.windows.net/” and generate/enable service principal
  POST: https://graph.windows.net/3tenant_id/servicePrincipals?api-version=1.6 >> HTTP 201
  Request body: basic app information, like name
  Request response: this application's generated data, like appid, object id

POST: https://graph.windows.net/tenant_id/servicePrincipals?api-version=1.6 >> HTTP 201
Request body: {"accountEnabled": "True", "appId": "xxxxx"}
Request response: this application's generated data, like appid, object id

• In the issue scenario, the error will occurred at second step:
  POST: https://graph.windows.net/3tenant_id/servicePrincipals?api-version=1.6 >> HTTP 201
  Request body: basic app information, like name
  Request response: this application's generated data, like appid, object id

POST: https://graph.windows.net/tenant_id/servicePrincipals?api-version=1.6 >> HTTP 403
Request body: {"accountEnabled": "True", "appId": "xxxxx"}
Request response: code":"Authorization_RequestDenied","message":{"lang":"en","value":"When using this permission, the backing application of the service principal being created must in the local tenant"},"requestId":"3896deac-4831-4503-a21b-eab9b467ca4f","date":"2021-06-22T02:06:5

• There is not any error can be found in the Azure AD audit log. All application generation seem to be successfully.
• The issue can be mitigated after re-run this command again

the issue occur in the middle of service principal generation process. We request the further investigation on this CLI command process.

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: e99d25ff-03e2-e015-37f4-a29b59ec50d4
• Version Independent ID: 1a8e88ed-72c7-fbe7-b0ad-68f23b3946cd
• Content: az ad sp
• Content Source: latest/docs-ref-autogen/ad/sp.yml
• Service: active-directory
• GitHub Login: Robert Outlaw (@rloutlaw)
• Microsoft Alias: routlaw

[yonzhan]

Jiashuo Li (@jiasli) for awareness

[jiasli]

We added retry logic for this AAD propagation issue in #17412. Please update to the latest Azure CLI and see if the issue is resolved.

[TonySh127-ms]

Thanks for your quick update. I will request the client update the CLI to latest version and observed more time. Many thanks