Join Meeting as Anonymuous result in error with code 7504.

Describe the issue
I am using Samples/V1.0Samples/LocalMediaSamples/PolicyRecordingBot folder to create a bot that can join and record a meeting. I have successfully made the bot join a call or meeting then records the audio. Then, when I try to join my bot into meeting from non-recording user in the same tenant-id, I got Insufficient enterprise tenant permissions, cannot access this API. error.

What I've done:

• Create recording policy from here
• Configure access policy, ref here

Application Permission (already granted admin consent):

Application.Read.All
Calls.AccessMedia.All
Calls.Initiate.All
Calls.InitiateGroupCall.All
Calls.JoinGroupCall.All
Calls.JoinGroupCallAsGuest.All
OnlineMeetingArtifact.Read.All
OnlineMeetingRecording.Read.All
OnlineMeetings.Read.All
OnlineMeetings.ReadWrite.All
OnlineMeetingTranscript.Read.All 
User.Read
VirtualEvent.Read.All

Code Snippet
Use Graph SDK API to get chat info and meeting info

var requestOptions = new List<Option>()
{
    new QueryOption("$filter", $"joinMeetingIdSettings/joinMeetingId%20eq%20'{joinMeetingId}'")
};

var joinMeetArgs = new JoinMeetingArgs();
var result = await graphClient.Users[objectId].OnlineMeetings.Request(requestOptions).GetAsync();
Console.WriteLine("Response: ");
foreach (var page in result)
{
    joinMeetArgs.chatInfo = page.ChatInfo;
    joinMeetArgs.organizerObjectId = page.Participants.Organizer.Identity.User.Id;
}

In another file, join bot with chat info and meeting info

var chatInfo = joinMeetArgs.chatInfo;
var meetingInfo = new OrganizerMeetingInfo()
{
    Organizer = new IdentitySet
    {
        User = new Identity
        {
            Id = joinMeetArgs.organizerObjectId,
            DisplayName = "Koh Aliong",
            AdditionalData = new Dictionary<string, object>
            {
                { "tenantId", "********-****-****-****-************" }
            }

        }
    }
};
meetingInfo.Organizer.User.SetTenantId("********-****-****-****-************");

var mediaSession = this.Client.CreateMediaSession(
    new AudioSocketSettings
    {
        StreamDirections = StreamDirection.Recvonly,
        SupportedAudioFormat = AudioFormat.Pcm16K,
        ReceiveUnmixedMeetingAudio = true,
    });

await this.Client.Calls().AddAsync(new JoinMeetingParameters(chatInfo, meetingInfo, mediaSession));

Expected behavior
Bot join the meeting

Graph SDK (please complete the following information):

• Version [e.g. 22]

Call ID
fa7b2940-4bc8-4f00-bfa8-37b109f9def6

Logs

Error: GraphAuthClient.cs:125 SendHttpRequestAsync
ScenarioId: 1ca1d702-2987-46a6-af76-58f3be75d0da
AppId: ********-****-****-****-************
AppName: MicrosoftTeamBot
TransactionDirection: Outgoing
TraceType: HttpResponse
ResponseTime: 1921
request: POST https://graph.microsoft.com/v1.0/communications/calls
response: 403 Forbidden
headers:
  Transfer-Encoding: chunked
  Strict-Transport-Security: max-age=31536000
  request-id: 89a99952-5791-4b97-8888-b3f34746ca94
  client-request-id: ab0384f3-cdbf-47b0-86ba-f015230da975
  x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"Southeast Asia","Slice":"E","Ring":"5","ScaleUnit":"000","RoleInstance":"SI1PEPF00001A31"}}
  scenario-id: 1ca1d702-2987-46a6-af76-58f3be75d0da
  Date: Mon, 11 Dec 2023 07:49:18 GMT
  Content-Type: application/json
{
  "@odata.type": "#microsoft.graph.errorResponse",
  "error": {
    "@odata.type": "#microsoft.graph.error",
    "code": "7504",
    "message": "Insufficient enterprise tenant permissions, cannot access this API.",
    "innererror": {
      "@odata.type": "#microsoft.graph.error",
      "date": "2023-12-11T07:49:18",
      "request-id": "89a99952-5791-4b97-8888-b3f34746ca94",
      "client-request-id": "ab0384f3-cdbf-47b0-86ba-f015230da975"
    }
  }
}

Additional context
I can join the bot to the meeting by using postman, but without media platform.

Start with Samples/V1.0Samples/LocalMediaSamples/PolicyRecordingBot/README.md and the bot code that builds JoinMeetingParameters. Compare the SDK request with the successful Postman request, then use the logged 403 response and code 7504 to identify the missing permission or unsupported scenario; done means documenting the required configuration or a confirmed limitation.