Programmatically create a subscription. Permission denied, but I can create in portal.

I have an MCA tenancy associated with an organisation, pay as you go. I also have a tenancy associated with me as an individual.

I'm trying to create subscriptions programmatically. There is an article - https://free.blessedness.top/en-us/azure/cost-management-billing/manage/programmatically-create-subscription-microsoft-customer-agreement?tabs=azure-powershell. I've also looked at projects in GitHub.

I can create subscriptions in the portal. Whenever I try through code, I get permission denied. I'm authenticated with the account that is the owner of the tenancy, billing scope, profile and invoice section, and for good measure I added 'Azure create subscription' to the invoice section. I've tried Powershell, Azure CLI and Rest - same issue. I've created management groups, and when I have a subscription, I can create resource groups and resources inside it. I'm stumped. Cursor and Claude are stumped.

I created the organisation tenancy because I thought it might be a limitation of the individual tenancy.

I will try creating a new Entra ID user account in the MCA org tenancy and see if that makes any difference, but it is a long shot.

I want to create subscriptions automatically because some architectures require multiple landing zones and I want to be able to build these with scripts. These are bootstrap scripts that create the basic pre-reqs before CI/CD pipelines do the rest. It is not much to create the subscriptions manually, but it is ugly to have to do that.

I've also got paid support as a developer and as a business MCA customer, but I can't create a ticket for the supposed 24*7 customer service - the wizards just come to a dead end but they do mention the article above, after that the option are all not applicable.