403 When creating group call with service hosted media

When attempting to create a group call with service hosted media, I receive a 403: Request authorization tenant mismatch.
Creating a regular call works fine.
Running a POST to the following URL:
https://graph.microsoft.com/beta/app/calls
I've essentially given all app permissions available to my test tenant to rule that out.
JWT Perms:
"roles": [
"Chat.UpdatePolicyViolation.All",
"Calls.JoinGroupCall.All",
"OnlineMeetings.Read.All",
"OnlineMeetings.ReadWrite.All",
"User.ReadWrite.All",
"Application.ReadWrite.OwnedBy",
"People.Read.All",
"Application.ReadWrite.All",
"Calls.InitiateGroupCall.All",
"Group.Read.All",
"Calls.JoinGroupCallAsGuest.All",
"Sites.Read.All",
"Sites.ReadWrite.All",
"Group.ReadWrite.All",
"Sites.Manage.All",
"User.Invite.All",
"User.Read.All",
"Chat.Read.All",
"ChannelMessage.Read.All",
"User.Export.All",
"Chat.ReadWrite.All",
"ChannelMessage.UpdatePolicyViolation.All",
"Member.Read.Hidden",
"Calls.AccessMedia.All",
"Sites.FullControl.All",
"Calls.Initiate.All"
],

Body:

{
     "subject": "Test Call123",
     "callbackUri": "https://url.ngrok.io/callback/calling",
     "source": {
     "identity": {
         "application": {
         "id": "appID"
         }
       }
     },  
     "targets": [
     {
         "identity": {
         "user": {
             "id": "userID",
             "displayName": "test name"
         }
       }
       },
       {
       "identity": {
         "user": {
             "id": "userID2",
             "displayName": "test name2"
         }
         }
     }   
     ],
     "requestedModalities": [ "audio" ],
     "mediaConfig": {
       "@odata.type": "#microsoft.graph.serviceHostedMediaConfig",
       "preFetchMedia": [
         {
           "uri": "https://cdn.contoso.com/beep.wav",
           "resourceId": "1D6DE2D4-CD51-4309-8DAA-70768651088E"
         },
         {
           "uri": "https://cdn.contoso.com/cool.wav",
           "resourceId": "1D6DE2D4-CD51-4309-8DAA-70768651088F"
         }
       ]
     },
     "chatInfo": {
       "threadId": "19:meeting_aergaergOTdlMjY0YTFiNTA0@thread.v2",
       "messageId": "0",
       "replyChainMessageId": null
     }
   
   }

Start by reproducing the POST to https://graph.microsoft.com/beta/app/calls using the supplied request body and JWT roles, then compare it with the regular-call request that succeeds. Focus on the serviceHostedMediaConfig and tenant context; done means identifying the cause of the 403 tenant mismatch and documenting a verified request or configuration that succeeds.