Invoke-PnPTenantTemplate results in (401) Unauthorized when using Managed Identity from an Azure VM

[NFTak]

I'm trying to apply a PNP Template to a SharePoint site using Invoke-PnPTenantTemplate with a managed identity as follows

$SPOConnection = Connect-PnPOnline -Url "https://tenant-admin.sharepoint.com" -ManagedIdentity -ReturnConnection Invoke-PnPTenantTemplate -Path $TemplateFile -Connection $SPOConnection

No matter what I do, I get a (401) Unauthorized. The script is running in an Azure VM, and I've already done the following.

• Activated managed Identity on the Azure VM
• Added the managed identity to the "SharePoint Administrator" Azure role
• Add-PnPAzureADServicePrincipalAppRole -Principal -AppRole "Sites.FullControl.All" -BuiltInType SharePointOnline -Connection $SPOConnection
• Add-PnPAzureADServicePrincipalAppRole -Principal -AppRole "SharePointTenantSettings.ReadWrite.All" -BuiltInType MicrosoftGraph -Connection $SPOConnection

Can someone tell me what I'm doing wrong or what I should do in order for the managed identity of my VM to be authorized to invoke PNP templates?