what is the minimum permission required for the service user to integrate MDM with on-premise active directory.