Always encrypted with SSMS cleanup error from Azure Key Vault
I am trying to set up a new encrypted version database using Azure Key Vault (I had this work previously). In SSMS Always Encrypted Wizard, I can select the table and column to encrypt, but I have a problem after selecting "Azure Key Vault" as my key store provider. I log in and the window briefly displays a dropdown that correctly lists my storage key in Azure, but then it disappears immediately and has a warning triangle with the word "Clear" next to it and a "Try Again" button. 
Clicking "Details" shows: 
Any ideas what this means and how to get the master to fill in?
I tried this on two different SQL 2016 installations with the same result and using SSMS from different machines.
I know he is saying, “We ran into problems connecting to Azure,” but since he logs in and lists (in a nutshell) my key store, what could be the connection issue?
Thank.
Details information
===================================
We're having trouble connecting to Azure (we're having trouble connecting to Azure)
===================================
Cleanup (Microsoft.SqlServer.Management.ServiceManagement)
Program location:
at Microsoft.SqlServer.Management.ServiceManagement.ResourceManagement.AzureKeyVaultKeyPermissionEnumConverter.ReadJson (JsonReader reader, type objectType, Object existingValue, JsonSerializer serializer) in Newtonsoft.Jsonson converter.Serialization.JsonsonSerue reader at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.PopulateList (IList list, JsonReader reader, JsonArrayContract, JsonProperty containerProperty, String id) Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateList (JsonTysonReader member, existing contract , String id)
Add SSMS version information here: Microsoft SQL Server Management Studio 13.0.16106.4 Microsoft Analysis Services Client Tools 13.0.1700.441 Microsoft Data Access Components (MDAC) 10.0.15063.0 Microsoft MSXML 3.0 4.0 6.0 Microsoft Internet Explorer 9.11.15063.0 Microsoft .NET Framework 4.0 .30319.42000 Operating System 6.3.15063
source to share
I was able to workaround by creating a KEY in the store by writing CREATE COLUMN MASTER KEY referencing the full version ID key from the store, creating a COLUMN ENCRYPTION KEY using the UI, then using the Always Encrypted wizard to encrypt the assigned columns with the appropriate keys.
source to share