I was able to “fix” this by assigning myself “owner” role for the sub I was struggling with. The whole sub alias permission model in Azure is weird and I don’t understand it… Permissions and roles for Aliases are separated from everything else for some reason. Anyways, this worked for me:
az role assignment create --assignee <your user or SP> --role owner --scope “providers/Microsoft.Subscription/aliases/<your-subscription-name>”