AKS - "NetworkPolicy is not supported (only azure and calico are supported)"

Rancher v2.3.6
Unable to create AKS cluster with advanced network config with azure and calico

The full error is as follows:

This cluster is currently Provisioning; areas that interact directly with it will not be available until the API is ready.

Containerservice.ManagedClustersClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="NetworkPolicyNotSupported" 
Message="NetworkPolicy is not supported (only azure and calico are supported)" Target="networkProfile.networkPolicy"

Errors in Azure pretty much say the same thing. If i create it with the basic networking it works, but that’s not what I need.

For reference this works just fine so I know its not azure
az aks create --resource-group ${resGrp} --name ${aks} --generate-ssh-keys --aad-server-app-id ${server_app_id} --aad-server-app-secret ${server_app_secret} --aad-client-app-id ${client_app_id} --aad-tenant-id ${tenantId} --network-plugin azure --dns-name-prefix "${resGrp}-dns"
–vnet-subnet-id ${subnet_id} --docker-bridge-address 172.17.0.1/16 --dns-service-ip $dns_service_ip --service-cidr $service_cidr `
–subscription $azureSubscriptionID --location eastus --kubernetes-version 1.16.7 --node-count 1 --node-vm-size Standard_D2s_v3 --network-policy calico