[BUG] Set-PnPGroup -SetAssociatedGroup Owners: Access denied.

[grryf]

Reporting an Issue or Missing Feature

We have new root sharepoint (production) site and I'm trying to create many new subsites for customers, then new sub-subsites for all projects. Creation works but when I set SetAssociatedGroup for first subsite I have following error:
(it works on same tenant, but another sharepoint site)
Set-PnPGroup throws Access Denied for new Sharepoint site but works on older site.

Set-PnPGroup -Identity 'Customer aaa aaa-0013X00002a2y4uQAA Owners' -SetAssociatedGroup Owners -Web 17d50682-6fdc-495b-b95d-6a4913fc8177
Set-PnPGroup : Access denied. You do not have permission to perform this action or access this resource.
At line:1 char:1

• Set-PnPGroup -Identity 'Customer aaa aaa-0013X00002a2y4uQAA Owner ...

•   + CategoryInfo          : WriteError: (:) [Set-PnPGroup], ServerUnauthorizedAccessException
    + FullyQualifiedErrorId : EXCEPTION,PnP.PowerShell.Commands.Principals.SetGroup
  
  

This works fine:

Set-PnPGroup -Identity 'Customer QIAGEN GmbH-0013X00002a2y4uQAA Owners' -Description '.' -Web 17d50682-6fdc-495b-b95d-6a4913fc8177

Expected behavior

It works on same tenant, but another sharepoint site. I enabled all same site and site collection features but it didn't help.

Actual behavior

Access denied.

Steps to reproduce behavior

Connect-PnPOnline -Url "https://aaa.sharepoint.com/sites/DMS/0013X00002a2y4uQAA" -UseWebLogin # as global admin
create new pnp group
set associated group fails as described

Which version of the PnP-PowerShell Cmdlets are you using?

• PnP PowerShell for SharePoint 2013
• PnP PowerShell for SharePoint 2016
• PnP PowerShell for SharePoint 2019
• PnP PowerShell for SharePoint Online

What is the version of the Cmdlet module you are running?

3.26.2010.0 (latest)

How did you install the PnP-PowerShell Cmdlets?

• MSI Installed downloaded from GitHub
• Installed through the PowerShell Gallery with Install-Module
• Other means