Azure Bicep from DevOps - Scope Microsoft.Resources/deployments Error

I have a bicep file that I'm able to run successfully from vscode. I'd like to run the same file from Azure DevOps.

This is the yaml from the DevOps pipeline:

task: AzureCLI@2    
displayName: Deploy Template
inputs:
  azureSubscription: ${{variables.azureSubscription}}
  scriptType: pscore
  scriptLocation: inlineScript
  inlineScript: az deployment group create `
    --resource-group rg-utrngen-${{variables.env}}-001 `
    --template-file bicep/utrngen.main.bicep `
    --parameters bicep/utrngen.parameters.${{variables.env}}.json

This fails with the following error:

The client '<objid-of-the-aad-appreg-for-the-devops-svc-con>' with object id '<objid-of-the-aad-appreg-for-the-devops-svc-con>' does not have authorization to perform action 'Microsoft.Resources/deployments/validate/action' over scope '/subscriptions/<sub-id-being-deployed-to>/resourcegroups/rg-utrngen-dev-001/providers/Microsoft.Resources/deployments/utrngen.main' or the scope is invalid

I'm using the same DevOps service connection as for many other pipelines that run ok. I'm not sure what the error is trying to tell me?