Purview Fabric Data Map Error

I am trying to ingest my Fabric data into Purview with Data Map

I am in the same tenant and following the steps for Scan same-tenant Fabric using Azure IR and Managed Identity in public network in: Connect to your Microsoft Fabric tenant in same tenant as Microsoft Purview | Microsoft Learn

1. I have created a Purview Managed Service Principal in Azure.
2. Created an Entra security group containing the Service Principal as a member
3. Updated Fabric settings:

• a. Semantic model execute queries REST API > Enabled for entire organization.
• b. Service principals can call Fabric public APIs > Enabled for entire organization.
• c. Service principals can access read-only admin APIs > Enabled for Entra security group
• d. Enhance admin API responses with detailed metadata > Enabled for entire organization.
• e. Enhance admin API responses with DAX and mashup expressions > Enabled for entire organization.
• f. Users can access data stored in OneLake with apps external to Fabric > Enabled.

From the Scan Monitor Error logs I see multiple errors of the form:

ErrorCode: UserError

OperationName: Enumerate

OperationItem: Filesystem: XXX, Directory: YYY/Files

Message: Error while enumerating the item.

ErrorId: ScanErr8000

ErrorCode: AuthenticationFailed

OperationName: Enumerate

OperationItem: https://app.fabric.microsoft.com/groups/XXX/lakehouses/YYY/files

Message: ADLS Gen2 operation failed for: Storage operation '' on container 'XXX' and path 'YYY/Files' get failed with 'Operation returned an invalid status code 'Forbidden''. Possible root causes: (1). It's possible because the service principal or managed identity don't have enough permission to access the data. (2). It's possible because some IP address ranges of Purview are not allowed by your Azure Storage firewall settings. Purview IP ranges please refer https://docs.microsoft.com/en-us/azure/data-factory/azure-integration-runtime-ip-addresses. If you allow trusted Microsoft services to access this storage account option in firewall, you must use https://docs.microsoft.com/en-us/azure/data-factory/connector-azure-blob-storage?tabs=data-factory#managed-identity. For more information on Azure Storage firewalls settings, see https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal.. Account: 'onelake'. FileSystem: 'XXX'. Path: 'YYY/Files'. ErrorCode: 'Forbidden'. Message: 'Forbidden'.

ErrorId: ScanErr0000

Can you advise what I should do/test to overcome this error? I am bit confused as neither (1) or (2) in message are referred to in Microsoft docs for connecting Purview to Fabric. I have anonymized some parts with XXX and YYY

Thanks