Even while logged in as a CCS Admin, trying to create a job or change an asset results in an error message.
Windows Server 2016 patch KB4507460 applied separately to the server without also applying KB4507459.
Microsoft's patch KB4507460 has a known issue:
"Some applications may fail to run as expected on clients of Active Directory Federation Services 2016 (AD FS 2016) after installation of this update on the server. Applications that may exhibit this behavior use an IFRAME during non-interactive authentication requests and receive X-Frame Options set to DENY."
This issue will cause calls to ADAM on the CCS application server to fail with a lack of permissions.
Microsoft's article on this KB mentions that fixes in KB4507459 will address this issue.
To resolve this issue either apply KB4507459 or apply cumulative patch KB4509091 which contains the same fixes and then restart the CCS Application server.