I think the Service Principal definitely works for workspaces created from scratch with the Service Principal. I've tested that in my test environment, and have not encountered these kinds of authentication problem.

The issue I am seeing is with workspaces created with user/password and token based authentication. Something, deep in those workspaces, still has permissions set up in such a way that Service Principal based configuration gives authentication errors.