Azure DevOps / Azure KeyVault: add Service Principal via Template deployment

I am deploying an Azure Key Vault with ARM templates and would like to add a Service Principal to the Access Control Policies. Therefore I create an App in the Azure Active Directory and get the Object Id of the App:

Then I add the entry to the parameter file:

"accessPolicies": {
    "value": [
        {
            "objectId": "xxx",
            "tenantId": "xxx",
            "permissions": {
                "keys": [
                    "Get",
                    "List",
                    "Update",
                    "Create",
                    "Import",
                    "Delete",
                    "Recover",
                    "Backup",
                    "Restore"
                ],
                "secrets": [
                    "Get",
                    "List",
                    "Set",
                    "Delete",
                    "Recover",
                    "Backup",
                    "Restore"
                ],
                "certificates": [
                "Get",
                "List",
                "Update",
                "Create",
                "Import",
                "Delete",
                "Recover",
                "Backup",
                "Restore",
                "ManageContacts",
                "ManageIssuers",
                "GetIssuers",
                "ListIssuers",
                "SetIssuers",
                "DeleteIssuers"
                ]
            }
        }
    ]
}

But in a subsequent Azure Key Vault task I get an Access Denied error.

What do I have to do to be able to add a Service Principal to the Azure Key Vault via Template deployment with proper access rights?