Service Account for ADSI Connector - Minimum privileges to update the AD extended attributes.

[Sakshi]

Hi, 

I have referred to ADSI connector guide, and it suggests that for Provisioning operations the Service Account needs to have "Enterprise Administrator" role. 

Preparing for Integration (saviyntcloud.com)

This does not follow the least privileged principals. Can you suggest on alternate roles/permission that can be granted for Write operations. 

[prashantChauhan]

Hi @Sakshi 

Below permissions are required for the Import/Provisioning operations:

Import:

-Directory Replication permission 

Provisioning:

-Read
-Write

Create/Delete child object provisioning:

-Create all child objects
-Delete all child objects

Move operation:

-Migrate SID history