I was missing an App Role for member type "Applications" as opposed to "Users/Groups", which I believe is the same problem addressed by @caiyi Ju, but I was able to use the portal screens instead of editing the manifest directly.

In the Azure portal go to the App Registration > Manage > App roles > Create app role and check Applications (or probably Both) for "Allowed member types"

In addition, I have already defined a Client Secret and Application ID URI for the App Registration.