ListKeys permissions required for adding queue message to Azure Storage using Windows Powershell Az module

Using the Az module for Powershell I need to put a message onto an Azure Storage queue. Proper RBAC permissions are assigned. I can do this just fine with the Azure CLI (which at the moment I cannot use on my target system unfortunately).

    function azLoginWithServicePrincipal {
        $tid = "tenant-id-guid"
        $appId = "app-id-guid"
        $thumb = "cert-thumbprint"
        Connect-AzAccount -ServicePrincipal -TenantId $tid -CertificateThumbprint $thumb -ApplicationId $appId
    }
    
    function enqueueMessage {
        param([string]$rg, [string]$acc, [string]$queue, [object]$msg)
        
        $json = [Microsoft.Azure.Storage.Queue.CloudQueueMessage]::new(($msg | ConvertTo-Json)) 
        $storageAccount = Get-AzStorageAccount -Name $acc -ResourceGroupName $rg
        $q = Get-AzStorageQueue –Name $queue –Context $storageAccount.Context
        $q.CloudQueue.AddMessageAsync($json)
    }


azLoginWithServicePrincipal
$data = @{ data= "some-text-data"}
enqueueMessage -rg "my-rg" -acc "my-storage-account" -queue "my-queue-name" -msg $data

Here's the output. You can see that there seems to be a permissions mismatch. ListKeys on that storage account is required. But why, this seems excessive. Moreover, AccountKeys have been disabled for that storage account, there is RBAC-only. Moreover, using the Azure CLI (and simpler syntax) that same security principal can add to the queue no problemo.

Get-AzStorageQueue: The client 'client-id-guid' with object id 'object-id-guid' does not have authorization to perform action
'Microsoft.Storage/storageAccounts/listKeys/action' over scope
'/subscriptions/subscription-id-guid/resourceGroups/my-rg/providers/Microsoft.Storage/storageAccounts/my-storage-account' or the scope is
invalid. If access was recently granted, please refresh your credentials.