Access denied in hybrid search crawl logs in multiple farm environment

We have two SharePoint 2013 farms (both July 2016 CU) configured for hybrid Search with the same Office 365 tenant.

One farm is crawling fine with no errors however after onboarding our second farm (using the OnboardHybrid-Search.ps1) we are getting "The request sent to the Search Content Service failed (access denied)." errors in the crawl log - but only for the second farm, the first farm still works fine.

In the ULS logs I can see lots of "AzureServiceProxy::SubmitDocuments: submit failed for the document status code Unauthorized" errors. Has anyone else come across this before? I understand this to be a supported configuration of hybrid search.