3800912 - BAS "Forbidden: Missing admin role" despite role collection assigned — IAS login name

User navigates to the SAP Business Application Studio Workspace Manager Admin URL:

https://<subdomain>.applicationstudio.cloud.sap/workspace-manager-ui/admin/index.html

and receives the error:

"Forbidden: Missing admin role"

This occurs even though the Business_Application_Studio_Administrator role collection appears correctly assigned to the user in the BTP Cockpit.
Authentication via a Custom IAS Tenant completes successfully, but the admin session cannot be established.
The user's email address is visible in the role collection assignment 

• SAP Business Application Studio
• SAP Business Technology Platform (BTP)
• SAP Cloud Identity Services – Identity Authentication (Custom IAS Tenant) configured as a trusted Identity Provider in the BTP subaccount
• Custom IAS Tenant configured with Subject Name Identifier = Login Name (used for principal propagation)

BAS, Business Application Studio, Forbidden, Missing admin role, 403, workspace manager, admin URL, IAS, Custom IAS Tenant, shadow user, login name, subject name identifier, NameID, identity mismatch, principal propagation, role collection, Business_Application_Studio_Administrator, BTP, SAP BTP, custom identity provider, SAML, trust configuration, access denied, authorization, CA-BAS-WS-MNG , KBA , CA-BAS-CNSM , OData service consumption from BAS , CA-BAS-WS-MNG , Dev Space Manager - SAP Business Application Studio , Problem