I just found out that error 403 was caused by default deny assignments on all permissions on the managed application. After updating technical configuration and adding Microsoft.Synapse/workspaces/administrators/write to bypass deny default deny assignments, app is not getting 403 error anymore :)