Sonarqube endpoint created using api script fail in build pipeline with with "The token you provided doesn't have sufficient rights to check license"

I am attempting to create a sonarqube service endpoint in azure devops using this api script below. It succesffuly generates the service connection, and visually looks identical to one manually created in the azure devops portal. How ever when used in a yaml pipeline, fails at the Prepare analysis on SonarQube step with the following error The token you provided doesn't have sufficient rights to check license.

If i manually changed every avaiable field of this connection (url/token/name) it still fails. if i recreate with these values but through the portal it works.

function createDevOpsServiceConnection {
<#
    .SYNOPSIS
    Creates a DevOps service connection through REST API
    .DESCRIPTION
    The scrip will help you creating an Azure DevOps service connection through the REST API. 
    .PARAMETER PersonalToken
    Personal Access Token. Check https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=preview-page
    .PARAMETER Organisation
    The Azure DevOps organisation name
    .PARAMETER ProjectName
    The Azure DevOps project where the service connection will be made
    .PARAMETER ManagementGroupId
    The management group id created in the tenant
    .PARAMETER ManagementGroupName
    The management group name created in the tenant
    .PARAMETER SubscriptionId
    The subscription id in the tenant where to connect
    .PARAMETER SubscriptionName
    The subscription name in the tenant where to connect
    .PARAMETER TenantId
    The tenant id where to connect
    .PARAMETER ApplicationId
    The application id (service principal) in the Azure AD 
    .PARAMETER ApplicationSecret
    The application secret, in plain text
    .EXAMPLE
    create-DevOpsServiceConnection.ps1 -personalToken xxx -organisation DevOpsOrganisation -ProjectName WVD -ManagementGroupId MGTGROUP1 -ManagementGroupName 'MGT GROUP 1' -TenantId xxx-xxx -ApplicationId xxx-xxx-xxx -ApplicationSecret 'verysecret'
#>

Param(
    [Parameter(Mandatory = $True)]
    [string]$PersonalToken,
    
    [Parameter(Mandatory = $True)]
    [string]$Organisation,
    
    [Parameter(Mandatory = $True)]
    [string]$ProjectName,

 
    [Parameter(Mandatory = $True, ParameterSetName = 'Subscription')]
    [string]$SubscriptionId,

    [Parameter(Mandatory = $True, ParameterSetName = 'Subscription')]
    [string]$SubscriptionName,

    [Parameter(Mandatory = $True)]
    [string]$TenantId,
    
    [Parameter(Mandatory = $True)]
    [string]$ApplicationId,
    
    [Parameter(Mandatory = $True)]
    [string]$ApplicationSecret
    
)

$AzureDevOpsAuthenicationHeader = @{Authorization = 'Basic ' + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$($personalToken)")) }

## Get ProjectId


$URL = "https://dev.azure.com/$($organisation)/_apis/projects?api-version=6.0"
Try {
    $ProjectNameproperties = (Invoke-RestMethod $URL -Headers $AzureDevOpsAuthenicationHeader -ErrorAction Stop).Value
    Write-Verbose "Collected Azure DevOps Projects"
}
Catch {
    $ErrorMessage = $_ | ConvertFrom-Json
    Throw "Could not collect project: $($ErrorMessage.message)"
}
$ProjectID = ($ProjectNameproperties | Where-Object { $_.Name -eq $ProjectName }).id
Write-Verbose "Collected ID: $ProjectID"
$ConnectionName = "sonarqube"

switch ($PsCmdlet.ParameterSetName) {
    Subscription { 
        $data = @{

        }
    }
}
# Create body for the API call
$Body = @{
    data                             = $data
    name                             = $ConnectionName
    type                             = "sonarqube"
    url                              = "http://mysonarqube:9000/"
    authorization                    = @{
        parameters = @{
            username = "admin"
            password =  'SONARQUBETOKEN'
        
        }
        scheme     = "UsernamePassword"
    }
    isShared                         = $True
    isReady                          = $True
    serviceEndpointProjectReferences = @(
        @{
            projectReference = @{
                id   = "xxxxxxxx"
                name = "projectname"
            }
            name             = $ConnectionName
        }
    )
}



$URL = "https://dev.azure.com/$organisation/$ProjectName/_apis/serviceendpoint/endpoints?api-version=6.1-preview.4"
$Parameters = @{
    Uri         = $URL
    Method      = "POST"
    Body        = ($Body | ConvertTo-Json -Depth 3)
    Headers     = $AzureDevOpsAuthenicationHeader
    ContentType = "application/json"
    Erroraction = "Stop"
}
try {
    Write-Verbose "Creating Connection"
    $Result = Invoke-RestMethod @Parameters
    Write-Host "$($Result.name) service connection created"
}
Catch {
    $ErrorMessage = $_ | ConvertFrom-Json
    Throw "Could not create Connection: $($ErrorMessage.message)"
}
    
}

createDevOpsServiceConnection -personalToken $env:AZURE_DEVOPS_EXT_PAT -organisation $env:org -ProjectName "Bicep" `
-TenantId $env:ARM_TENANT_ID -ApplicationId $env:ARM_CLIENT_ID -ApplicationSecret $env:ARM_CLIENT_SECRET -SubscriptionId $ENV:ARM_SUBSCRIPTION_ID `
-SubscriptionName $env:sbname

Original script that this is based on can be found here; https://raw.githubusercontent.com/srozemuller/Azure/main/DevOps/Automation/create-DevOpsServiceConnection.ps1