Microsoft Graph PATCH to b2bManagementPolicies returns 404 Request_ResourceNotFound while GET succeeds

Attached is my script

read/list/coutn domainsn works good

but when I try to add domains, or remove domains, it fails with 400

#requires -Version 5.1
<#
.SYNOPSIS
.FEATURES
    1. Certificate-based app-only authentication
    2. Check a domain
    3. List allowed domains
    4. Add a domain
    5. Remove a domain
.REQUIREMENTS
    Microsoft.Graph.Authentication module
    Application permissions with admin consent:
      - Policy.Read.All
      - Policy.ReadWrite.B2BManagementPolicy
#>
# ------------------------------------------------------------
# CONFIGURATION
# ------------------------------------------------------------
$TenantId = "tenamt id"
$ClientId = "certid
$CertificateThumbprint = "certhumbprint"
$GraphUri = "https://graph.microsoft.com/beta/policies/b2bManagementPolicies"
$PolicyId = "a6916bec-d83f-40a5-8289-743db8bb967c"
$PolicyUri = "$GraphUri/$PolicyId"
# ------------------------------------------------------------
# AUTHENTICATION
# ------------------------------------------------------------
function Connect-ToGraph {
    Import-Module Microsoft.Graph.Authentication -ErrorAction Stop
    $cert = Get-Item `
        "Cert:\CurrentUser\My\$CertificateThumbprint" `
        -ErrorAction Stop
    if (-not $cert.HasPrivateKey) {
        throw "Certificate does not have an associated private key."
    }
    Connect-MgGraph `
        -TenantId $TenantId `
        -ClientId $ClientId `
        -Certificate $cert `
        -NoWelcome `
        -ErrorAction Stop
    $context = Get-MgContext
    if ($context.TenantId -ne $TenantId -or
        $context.ClientId -ne $ClientId) {
        throw "Connected Graph context does not match the configured tenant/app."
    }
    Write-Host "`nAuthentication successful." -ForegroundColor Green
    Write-Host "Tenant ID : $($context.TenantId)"
    Write-Host "Client ID : $($context.ClientId)"
    Write-Host "Auth type : $($context.AuthType)"
}
# ------------------------------------------------------------
# READ POLICY
# ------------------------------------------------------------
function Get-B2BPolicy {
    $policy = Invoke-MgGraphRequest `
        -Method GET `
        -Uri $PolicyUri `
        -ErrorAction Stop
    return $policy
}
function Get-AllowedDomains {
    $policy = Get-B2BPolicy
    $definitionJson = [string]$policy["definition"][0]
    $definition = $definitionJson | ConvertFrom-Json
    $domains = @(
        $definition.B2BManagementPolicy.
            InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains
    )
    return $domains
}
# ------------------------------------------------------------
# CHECK DOMAIN
# ------------------------------------------------------------
function Test-AllowedDomain {
    $domain = (Read-Host "Enter domain to check").Trim().ToLowerInvariant()
    if ([string]::IsNullOrWhiteSpace($domain)) {
        Write-Host "Domain cannot be empty." -ForegroundColor Yellow
        return
    }
    $domains = @(Get-AllowedDomains)
    if ($domains -contains $domain) {
        Write-Host "$domain is already allowed." -ForegroundColor Green
    }
    else {
        Write-Host "$domain is not in the allowed-domain list." `
            -ForegroundColor Yellow
    }
}
# ------------------------------------------------------------
# LIST DOMAINS
# ------------------------------------------------------------
function Show-AllowedDomains {
    $domains = @(Get-AllowedDomains)
    Write-Host "`nAllowed domains: $($domains.Count)" `
        -ForegroundColor Cyan
    if ($domains.Count -eq 0) {
        Write-Host "No allowed domains found."
        return
    }
    $domains | Sort-Object | ForEach-Object {
        Write-Host " - $_"
    }
}
# ------------------------------------------------------------
# UPDATE POLICY
# ------------------------------------------------------------
function Set-AllowedDomains {
    param(
        [Parameter(Mandatory = $true)]
        [string[]]$Domains
    )
    # Read the latest policy so other policy properties are preserved.
    $policy = Get-B2BPolicy
    $definitionJson = [string]$policy["definition"][0]
    $definition = $definitionJson | ConvertFrom-Json
    $definition.B2BManagementPolicy.
        InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains = @($Domains)
    # The Graph policy definition is represented as a JSON string
    # inside the definition array.
    $updatedDefinitionJson = $definition | ConvertTo-Json -Depth 20 -Compress
    $description = [string]$policy["description"]
    if ([string]::IsNullOrWhiteSpace($description)) {
        $description = "B2B management policy for allowed guest invitation domains"
    }
    $body = @{
        isOrganizationDefault = [bool]$policy["isOrganizationDefault"]
        displayName           = [string]$policy["displayName"]
        description           = $description
        definition            = @($updatedDefinitionJson)
    }
    $bodyJson = $body | ConvertTo-Json -Depth 10
    try {
        Invoke-MgGraphRequest `
            -Method PATCH `
            -Uri $PolicyUri `
            -ContentType "application/json" `
            -Body $bodyJson `
            -ErrorAction Stop | Out-Null
        # Verify the result by reading the policy again.
        $verifiedDomains = @(Get-AllowedDomains)
        if (@($verifiedDomains | Where-Object {
            $_ -notin $Domains
        }).Count -eq 0 -and
            @($Domains | Where-Object {
                $_ -notin $verifiedDomains
            }).Count -eq 0) {
            Write-Host "Policy update and verification successful." `
                -ForegroundColor Green
        }
        else {
            Write-Warning "PATCH returned successfully, but read-back differs from the requested list."
        }
    }
    catch {
        Write-Host "`nPolicy update failed." -ForegroundColor Red
        Write-Host $_.Exception.Message -ForegroundColor Red
        Write-Host "No successful change has been confirmed. Check the policy before retrying."
    }
}
# ------------------------------------------------------------
# ADD DOMAIN
# ------------------------------------------------------------
function Add-AllowedDomain {
    $domain = (Read-Host "Enter domain to add").Trim().ToLowerInvariant()
    if ($domain -notmatch '^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$') {
        Write-Host "Invalid domain format." -ForegroundColor Yellow
        return
    }
    $domains = @(Get-AllowedDomains)
    if ($domains -contains $domain) {
        Write-Host "$domain is already allowed." -ForegroundColor Yellow
        return
    }
    Write-Host "`nCurrent domains: $($domains.Count)"
    Write-Host "Domain to add  : $domain"
    if ((Read-Host "Type ADD to confirm") -cne "ADD") {
        Write-Host "Operation cancelled."
        return
    }
    $newDomains = @($domains) + @($domain)
    Set-AllowedDomains -Domains $newDomains
}
# ------------------------------------------------------------
# REMOVE DOMAIN
# ------------------------------------------------------------
function Remove-AllowedDomain {
    $domain = (Read-Host "Enter domain to remove").Trim().ToLowerInvariant()
    $domains = @(Get-AllowedDomains)
    if ($domains -notcontains $domain) {
        Write-Host "$domain is not in the allowed-domain list." `
            -ForegroundColor Yellow
        return
    }
    Write-Host "`nDomain to remove: $domain"
    if ((Read-Host "Type REMOVE to confirm") -cne "REMOVE") {
        Write-Host "Operation cancelled."
        return
    }
    $remainingDomains = @(
        $domains | Where-Object { $_ -ne $domain }
    )
    Set-AllowedDomains -Domains $remainingDomains
}
# ------------------------------------------------------------
# MAIN MENU
# ------------------------------------------------------------
try {
    Connect-ToGraph
    do {
        Write-Host "`n===================================="
        Write-Host " B2B ALLOWED-DOMAIN MANAGEMENT"
        Write-Host "===================================="
        Write-Host "1. Check domain"
        Write-Host "2. List allowed domains"
        Write-Host "3. Add domain"
        Write-Host "4. Remove domain"
        Write-Host "Q. Quit"
        $choice = (Read-Host "`nSelect option").Trim().ToUpperInvariant()
        try {
            switch ($choice) {
                "1" { Test-AllowedDomain }
                "2" { Show-AllowedDomains }
                "3" { Add-AllowedDomain }
                "4" { Remove-AllowedDomain }
                "Q" { Write-Host "Exiting." }
                default {
                    Write-Host "Invalid selection. Choose 1, 2, 3, 4, or Q." `
                        -ForegroundColor Yellow
                }
            }
        }
        catch {
            Write-Host "Operation failed: $($_.Exception.Message)" `
                -ForegroundColor Red
        }
    } while ($choice -ne "Q")
}
catch {
    Write-Host "Startup or authentication failed: $($_.Exception.Message)" `
        -ForegroundColor Red
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue
}