@Koppelaar P.J. (Pieter) Apologies for the inconvenience regarding this issue. This is a by design behavior as creating azure sandbox only provides user with contributor access so anything with AAD/RBAC will result in permission error.
Given that, we should be converting this module to use BYOS model – bring your own subscription in order for users to complete the provided steps.
I will notify the owner of this module to have this scheduled to be changed as soon as possible.
Let me know if you have any further questions, feel free to post back.