I think you might be in this situation:
"Symptom - Role assignments for management group changes are not being detected
You created a new child management group and the role assignment on the parent management group is not being detected for the child management group.
Cause
Azure Resource Manager sometimes caches configurations and data to improve performance.
Solution
It can take up to 10 minutes for the role assignment for the child management group to take effect. If you are using the Azure portal, Azure PowerShell, or Azure CLI, you can force a refresh of your role assignment changes by signing out and signing in. If you are making role assignment changes with REST API calls, you can force a refresh by refreshing your access token."