Turns out I was using the object/principal ID, not the app/client ID when registering the service connection. Once that was resolved, it worked as expected.