Azure ARM template ResourceNotFound error when referencing managed identity in key vault access policy

I've used this as the reference with an App Service:

[reference(resourceId('Microsoft.Web/sites', variables('webAppName')), '2016-08-01', 'Full').identity.principalId]

and the dependsOn of course:

[resourceId('Microsoft.Web/sites', variables('webAppName'))]