"Access Denied" when Enabling Private CDN

I'm trying to use Organizational Assets, which also enables a private CDN. My tenant admin is entering the following command to enable the asset library, but is getting "access denied" at what seems like the CDN part. 

Add-SPOOrgAssetsLibrary -LibraryURL https://custbank.sharepoint.com/sites/SteveHubSiteTest/(site URL) -ThumbnailURL https://custbank.sharepoint.com/sites/SteveHubSiteTest/(image URL) -OrgAssetType ImageDocumentLibrary

He was successfully able to execute this command though:

Set-SPOTenantCdnEnabled -CdnType Private -Enable $true

So it doesn't appear to be an issue turning on the CDN itself, but I'm not familiar with the entire process.

I also made him an owner of the site that's the target of the library.