MSDeploy fails with authorization error when using filePath provider - iis

Question

I am trying to deploy a web application using MSDeploy. In the first step the app is deployed to test server (using the package created during the build), then to production server (source and destination are iisApp) and the next step is production web.config file deployment to the production server.
Everything works fine but the web.config file deployment reports an error
Error Code: ERROR_USER_NOT_AUTHORIZED_FOR_DEPLOYMENTPROVIDER
More Information: Could not complete an operation with the specified
provider ("filePath") when connecting using the Web Management Service.
This can occur if the server administrator has not authorized the user for
this operation. filePath http://go.microsoft.com/fwlink/?LinkId=178034
Learn more at: http://go.microsoft.com/fwlink/?LinkId=221672#ERROR_USER_NOT_AUTHORIZED_FOR_DEPLOYMENTPROVIDER.
I am using the same machine for deployment, the same username and the same password. I can see the user has filePath deployment enabled (as well dirPath, contentPath, iisApp and setAcl) in the Management Service Delegation screen in IIS Manager on the machine used for deployment:
It also fails for dirPath and contentPath.
Can anybody help? Thanks
Update - log when MSDeploy executed with -verbose flag
"C:\Program Files (x86)\IIS\Microsoft Web Deploy V3\msdeploy"
-verb:sync -source:filePath="C:\MyProject\DeployConfig\web\web.config"
-dest:filePath="web/web.config",computerName="https://deployement:8172/MSDeploy.axd?site=my-site",userName="publish",password="password",authtype="Basic",includeAcls="False"
-allowUntrusted -verbose
Info: Using ID '7fcedfe4-c103-48f4-ab98-4fae743d5eb7' for connections to the remote server.
Verbose: Pre-authenticating to remote agent URL 'https://deployment:8172/MSDeploy.axd?site=my-site' as 'publish'.
Verbose: Performing synchronization pass #1.
Verbose: Pre-authenticating to remote agent URL 'https://deployment:8172/MSDeploy.axd?site=my-site' as 'publish'.
Verbose: No backup was executed.
Verbose: Received response from agent (HTTP status 'OK').
Info: Adding MSDeploy.filePath (MSDeploy.filePath).
Verbose: The dependency check 'DependencyCheckInUse' found no issues.
Verbose: The current synchronization pass is missing stream content for 1 objects.
Info: Using ID '8f582c09-614e-4344-87c9-64867e44fc4e' for connections to the remote server.
Verbose: Performing synchronization pass #2.
Verbose: Pre-authenticating to remote agent URL 'https://deployment:8172/MSDeploy.axd?site=my-site' as 'publish'.
Info: Adding MSDeploy.filePath (MSDeploy.filePath).
Verbose: Received response from agent (HTTP status 'OK').
Info: Adding child MSDeploy.filePath (C:\MyProject\DeployConfig\web\web.config).