Permission

There are two Options:

1. Run As User: Global Admin or Privilege Admin is required because an Restricted Management Administrative Unit will created. The Later Operations can be delegated to the "CA Administrator" + "CA_Admin" Group

2. Run As Workload Identity (App Registration or Managed Identity)

• "AdministrativeUnit.ReadWrite.All",
• "Agreement.Read.All",
• "Application.Read.All",
• "Group.ReadWrite.All",
• "Policy.Read.All",
• "Policy.ReadWrite.ConditionalAccess",
• "RoleManagement.ReadWrite.Directory"