Managed Identities + RBAC: Web App invoking data plane operation on the Blob Storage fails with 403

Question

Hi, I have prepared a managed application definition based on the already exiting ARM template. It is an application that contains code being deployed to Web Apps on App Service. The security is organized based on the SystemAssigned managed identities and appropriate role assignments in data plane.
The solution works fine when deployed in a regular way. However with exactly the same role assignments we observe 403 errors on writes to Storage Account (Blob).

How to achieve Managed Identities (system assigned) + RBAC based security within Managed Resource Group for a scenario infrastructure + application code? Presumably there is a policy that forcefully blocks writes (data plane) for Managed Resource Group resources?

Should we convert to KeyVault based connection strings/shared access tokens?

Best regards