I got the same issue even the identity has resoure group ownership. I guess that the container group created on the fly doesn't have managed identity assigned with proper permission.