Turns out Entra Groups are not supported.
https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-logins?view=azuresql#microsoft-entra-group-server-principal-limitations