API call to modify Workspace Diagnostics does not work when run under a Service Principal

Have you tried granting admin permissions to the Service Principal at the workspace level instead of to the entire security group?

You can also test the code below in PowerShell ISE and verify the response you receive. Make sure to provide the Service Principal details, as well as the Workspace ID and Lakehouse ID where diagnostic is enabled.
Request body is just a sample from documentation: https://learn.microsoft.com/en-us/rest/api/fabric/core/onelake-settings/modify-diagnostics

$TenantId       = "YOUR_TENANT_ID"
$ClientId       = "YOUR_CLIENT_ID"
$ClientSecret   = "YOUR_CLIENT_SECRET"

$WorkspaceId    = "YOUR_WORKSAPCE_ID"
$LakehouseItemId = "YOUR_LAKEHOUSE_ID"

$tokenUrl = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"

$tokenBody = @{
    grant_type    = "client_credentials"
    client_id     = $ClientId
    client_secret = $ClientSecret
    scope         = "https://api.fabric.microsoft.com/.default"
}

try {
    $tokenResponse = Invoke-RestMethod -Method Post -Uri $tokenUrl -ContentType "application/x-www-form-urlencoded" -Body $tokenBody
    $accessToken = $tokenResponse.access_token
    Write-Host "Access token acquired successfully." -ForegroundColor Green
}
catch {
    Write-Error "Failed to acquire access token: $_"
    exit 1
}

$apiUrl = "https://api.fabric.microsoft.com/v1/workspaces/$WorkspaceId/onelake/settings/modifyDiagnostics"

$body = @{
    status      = "Enabled"
    destination = @{
        type      = "Lakehouse"
        lakehouse = @{
            referenceType = "ById"
            itemId        = $LakehouseItemId
            workspaceId   = $WorkspaceId
        }
    }
} | ConvertTo-Json -Depth 5

$headers = @{
    Authorization  = "Bearer $accessToken"
    "Content-Type" = "application/json"
}

try {
    $response = Invoke-WebRequest -Method Post -Uri $apiUrl -Headers $headers -Body $body -UseBasicParsing
    Write-Host "Response Code: $($response.StatusCode)" -ForegroundColor Green
    Write-Host "Diagnostics setting modified successfully." -ForegroundColor Green
    if ($response.Content) {
        $response.Content | ConvertFrom-Json | ConvertTo-Json -Depth 5
    }
}
catch {
    if ($_.Exception.Response) {
        $statusCode = [int]$_.Exception.Response.StatusCode
        Write-Error "API call failed with status code: $statusCode"
        $reader = New-Object System.IO.StreamReader($_.Exception.Response.GetResponseStream())
        $errorBody = $reader.ReadToEnd()
        Write-Error "Response body: $errorBody"
    }
    else {
        Write-Error "API call failed: $($_.Exception.Message)"
    }
}

 
You should receive following status: