[Claidheamhmor]

Found the issue:

In BDS Admin, user Microsoft Active Directory Integration, Manage Microsoft Active Directory Access, I had to edit Active Directory Configuration.

The "Microsoft Active Directory Access" section requires the BDS Admin account details for the resource domain.

The "Microsoft Active Directory Login" section requires the account details on the account/user domain for an account with (presumably) account operator rights.