I'm trying to use Organizational Assets, which also enables a private CDN. My tenant admin is entering the following command to enable the asset library, but is getting "access denied" at what seems like the CDN part.
Add-SPOOrgAssetsLibrary -LibraryURL https://(site URL) -ThumbnailURL https://(image URL) -OrgAssetType ImageDocumentLibrary
He was successfully able to execute this command though:
Set-SPOTenantCdnEnabled -CdnType Private -Enable $true
So it doesn't appear to be an issue turning on the CDN itself, but I'm not familiar with the entire process.
I also made him an owner of the site that's the target of the library.