Minimum permissions required for Services Catalogue Manager

applies to simple services activate services that add a user to an ad group and that don’t contain custom configuration that manipulates objects or services other than ad group membership the rights required for complex services that manage more than ad group membership will need to be based on the actions the service performs when it is provisioned or de provisioned please contact your activate provider to determine the rights required active directory permissions required grant to activate orchestrator service account grant on ou(s) that contain the groups that the service will add users to ou and all descendant objects rights list contents read all properties write all properties read permissions notes if possible, remove permissions for users other than the activate orchestrator service account to manage groups in the ou(s)