Add AAD groups to API Management

Hello, I have configured AAD in Identities for API Management service incl. app registration with the following API permissions:

• Directory.Read.All
• User.Read
  for Azure Active Directory Graph and Microsoft Graph as well

In the Developer portal (settings) | Groups, I'm able to list all AAD groups from my tenant by + Add Azure AD group. But when I try to add any of them, the invoked request fails with 400 and the error message is

"Failed to query Azure Active Directory graph due to error: Invalid URI: The format of the URI could not be determined."

The original request body that azure portal sending looks like:
{ "properties": { "type": "external", "displayName": "DisplayName", "description": null, "externalId": "aad://{tenand_id}/groups/{group_id}" } }

When I intercept the request, remove aad:// prefix from externalId ( "externalId": "{tenand_id}/groups/{group_id}" ) and forward the request, the group was successfully added.

But with this little hack, it doesn't work when I try to add permission for a particular group and products. In the portal it looks like permission is configured correctly, but developers don't see their products in the portal GUI (*.developer.azure-api.net) even after publishing a new version.

I'm almost sure that it worked one month ago. Can you please help me? Am I doing something wrong, or why is the APIM service failing with Azure AD Graph API query?