Normally you get this error if you run "service cme test" without setting up azure AD application and application access to subscription.
Following the admin guide: Don´t run service cme test before you finished Step 5.
In addition, the CME Log should give a good understanding what´s going on in the background.
Review logs are created by the CME on the Management Server:
/var/log/CPcme/cme.log*
look for an authorization failed message like the following:
cloud_connectors.https.RequestException: HTTP/1.1 403 Forbidden
b'{"error":{"code":"AuthorizationFailed","message":"The client \'xxxxxxxxxxx' with object id \'xxxxxxxxxx' does not have authorization to perform action \'Microsoft.Network/virtualNetworks/read\' over scope \'/subscriptions/xxxxxxxx\' or the scope is invalid. If access was recently granted, please refresh your credentials."}}'