How to deploy an on-premises gateway service using service principal - azure

Question

I'm using an on-premises gateway connection in Azure and I'm trying to deploy this using an ARM-template from a VSTS deployment. The VSTS deployment has an Resource Manager end-point. It seems that the service principal cannot create the On-premises Data Gateway service in Azure because it has no permission to the registered Gateway that is located in:
/subscriptions/{subscriptionid}/providers/Microsoft.Web/locations/{location}/connectionGatewayInstallations/{OnPremGatewayId}
The code in the ARM template is quite straigtforward and looks like this:
{
"type": "Microsoft.Web/connectionGateways",
"name": "[variables('OnPremGatewayName')]",
"apiVersion": "2016-06-01",
"location": "[resourceGroup().location]",
"scale": null,
"properties": {
"connectionGatewayInstallation": {
"id": "[concat('/subscriptions/', subscription().subscriptionid, '/providers/Microsoft.Web/locations/', toLower(replace(resourceGroup().location,' ','')),'/connectionGatewayInstallations/', parameters('OnPremGatewayId'))]"
}
},
"dependsOn": []
},
The deployment throws this error:
"error": {
"code": "AuthorizationFailed",
"message": "The connection gateway 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx' does not exist or the client with object id 'xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx' under tenant id '********' does not have administrative rights on it."
}
}'
I've found that there is a new action added that you can assign to a role:
/Microsoft.Web/Locations/connectiongatewayinstallations/Read
I've created a role with this action and added it to the service principal, but dat didn't seem to help. I used the following script to create the role:
$role = Get-AzureRmRoleDefinition "Virtual Machine Contributor"
$role.Id = $null
$role.Name = "On premises data gateway reader"
$role.Description = "Read registered On premises data gateways"
$role.Actions.Clear()
$role.Actions.Add("/Microsoft.Web/Locations/connectiongatewayinstallations/Read")
$role.AssignableScopes.Clear()
$role.AssignableScopes.Add("/subscriptions/{subscriptionid}")
New-AzureRmRoleDefinition -Role $role
Get-AzureRmRoleDefinition -Name "On premises data gateway reader"
How can I give the VSTS service principal administrative rights on the registered gateway?