To enable the restore action for service principals within your custom role, add the Microsoft.Directory/servicePrincipals/restore action to the allowedResourceActions list.
You can try adding this at the end of your list... "microsoft.directory/servicePrincipals/restore"