InvalidAudience: Unable to authenticate to Hybrid Connection

[cawoodm]

We created a connection with 2 SAS Policies "defaultSender" and "defaultListener" and are unable to connect. The undocumented and inexplicable error is:

InvalidAudience: The authorization header contains a token with a wrong audience.

[Reflection.Assembly]::LoadWithPartialName("System.Web") | out-null
$URI = "our-servicebus-name.defaultSender.windows.net"
$Access_Policy_Name = "defaultSender"
$Access_Policy_Key = "<primaryKey>"
$Expires = ([DateTimeOffset]::Now.ToUnixTimeSeconds()) + 300
$SignatureString = [System.Web.HttpUtility]::UrlEncode($URI) + "`n" + [string]$Expires
$HMAC = New-Object System.Security.Cryptography.HMACSHA256
$HMAC.key = [Text.Encoding]::ASCII.GetBytes($Access_Policy_Key)
$Signature = $HMAC.ComputeHash([Text.Encoding]::ASCII.GetBytes($SignatureString))
$Signature = [Convert]::ToBase64String($Signature)
$SASToken = "SharedAccessSignature sr=" + [System.Web.HttpUtility]::UrlEncode($URI) + "&sig=" + [System.Web.HttpUtility]::UrlEncode($Signature) + "&se=" + $Expires + "&skn=" + $Access_Policy_Name
$SASToken

This produces: SharedAccessSignature sr=our-servicebus-name.defaultSender.windows.net&sig=***&se=1730135799&skn=defaultSender

Nowhere in Azure Portal near Hybrid Connections is any explanation of how to generate an SAS nor how to pass one.