We are trying to create Azure subscriptions using Terraform & deploying through Github Actions. where we are obtaining the error message in terraform apply stage. Attaching the screenshot for reference. The use case description is below for reference:

1. SPN (Azure Service principal) created in Azure environment is used for this deployment.
2. SPN is assigned Owner role in Tenant level.
3. Have also followed this link & assigned the necessary privileges for the subscription creator role using API on enrollment account.
4. we have the set the Github Actions "Secrets" perfect with the same SPN details for authenticating the environment & rest resources are getting spun up well.

Link: https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/assign-roles-azure-service-principals#assign-the-subscription-creator-role-to-the-spn.

Error Message:

creating new Subscription (Alias "823XXXXXXX-285b-4084-92d8-885a43a7f7a5"): subscription.AliasClient#Create: Failure sending request: StatusCode=401 -- Original Error: Code="UserNotAuthorized" Message="User is not authorized to create subscriptions on this enrollment account"

Error message screenshot:

Any guidance or help on this will be very useful for us a quick solution!! Thanks in Adavnce!