pulumi-azure: Unable to assing keyvault Access Policy to function app identity

I try to set up a azure function with a managed identity to get permission to access a keyvault.

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const current = pulumi.output(azure.core.getClientConfig({}));

const resourceGroup = new azure.core.ResourceGroup("resourceGroup", {
    location: "WestUS",
});

const plan = new azure.appservice.Plan("plan", {
    kind: "functionapp",
    location: resourceGroup.location,
    name: "plan",
    resourceGroupName: resourceGroup.name,
    sku: {
        size: "Y1",
        tier: "Dynamic",
    },
});

const storage = new azure.storage.Account("storage", {
    accountKind: "StorageV2",
    accountReplicationType: "LRS",
    accountTier: "Standard",
    location: resourceGroup.location,
    name: "storage",
    resourceGroupName: resourceGroup.name,
});

const functionApp = new azure.appservice.FunctionApp("function", {
    appServicePlanId: plan.id,
    identity: {
        type: "SystemAssigned",
    },
    location: resourceGroup.location,
    name: "function",
    resourceGroupName: resourceGroup.name,
    storageConnectionString: storage.primaryConnectionString,
    version: "~2",
});
const keyvault = new azure.keyvault.KeyVault("keyvault", {
    location: resourceGroup.location,
    name: "keyvault",
    resourceGroupName: resourceGroup.name,
    sku: {
        name: "standard",
    },
    tenantId: current.apply(current => current.tenantId),
});

const app = new azure.keyvault.AccessPolicy("app", {
    keyPermissions: [],
    keyVaultId: keyvault.id,
    objectId: functionApp.identity.apply(identity => identity.principalId),
    secretPermissions: ["get"],
    tenantId: functionApp.identity.apply(identity => identity.tenantId),
});

this script results in following error:

$ pulumi up
Previewing update (dev3):

     Type                             Name           Plan       Info
 +   pulumi:pulumi:Stack              test2-dev3     create
 +   ├─ azure:core:ResourceGroup      resourceGroup  create
 +   ├─ azure:keyvault:KeyVault       keyvault       create
 +   ├─ azure:appservice:Plan         plan           create
 +   ├─ azure:storage:Account         storage        create
 +   ├─ azure:appservice:FunctionApp  function       create
     └─ azure:keyvault:AccessPolicy   app                       2 errors

Diagnostics:
  azure:keyvault:AccessPolicy (app):
    error: azure:keyvault/accessPolicy:AccessPolicy resource 'app' has a problem: "tenant_id": required field is not set
    error: azure:keyvault/accessPolicy:AccessPolicy resource 'app' has a problem: "object_id": required field is not set

error: an error occurred while advancing the preview

Why does pulumi does not accept the tenant_id and object_id the pulumi.Output as field?