I have the following script that is executed in a release pipeline:

```
$keyVaultName = "brajzorekeyvault"
$keyVaultMySecret =  az keyvault secret show --name "MySecret" --vault-name $keyVaultName
$keyVaultMySecretId = ($keyVaultMySecret | ConvertFrom-Json).id
$location = "northeurope"
$resourceGroup = "Test"
$appServicePlan = "brajzoreappserviceplan"
$appServiceName = "brajzoreappservice"

Write-Host "Create resource group $resourceGroup"

az group create `
    -l $location `
    -n $resourceGroup

Write-Host "Create App Service Plan $appServicePlan"

az appservice plan create `
    --resource-group $resourceGroup `
    --name $appServicePlan `
    --location $location `
    --sku S1 `
    --number-of-workers 2

Write-Host "Create App Service $appServiceName"

az webapp create `
    --name $appServiceName `
    --resource-group $resourceGroup `
    --plan $appServicePlan

Write-Host "Create App Service Identity $appServiceName"

$appServiceIdentity = az webapp identity assign `
    --name $appServiceName `
    --resource-group $resourceGroup

$objectId = ($appServiceIdentity | ConvertFrom-Json).principalId
Write-Host "Created identity $objectId"

Write-Host "Assigned $appServiceIdentity"

Write-Host "Azure az keyvault set-policy using $objectId"

az keyvault set-policy `
    --name $keyVaultName `
    --secret-permissions get list `
    --output none `
    --object-id $objectId

```

When I run this pipeline, i get the following error:

```
2021-03-08T12:01:58.8032755Z ERROR: The user, group or application 'appid=***;oid=8e00ef3a-edb2-4aa7-88cd-8b03ea083454;iss=https://sts.windows.net/***/' does not have secrets get permission on key vault 'brajzorekeyvault;location=northeurope'. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287

```

What am I doing wrong? What kind of policy do I have to set in the key vault either to get the pipeline to not throw an error?

I can't find any principal with object Id 8e00ef3a-edb2-4aa7-88cd-8b03ea083454 in the list of Principals.