Least-privilege admin role for common M365 and Copilot-governance tasks
This sheet compares Minimum role, Over-broad or wrong pick.
| Criterion | Minimum role | Over-broad or wrong pick |
|---|---|---|
| Approve a pending agent request in the Agent Registry | AI Administrator or Global Administrator | Helpdesk Administrator (can view, not approve) |
The verdict, the full comparison, 5 rules and 4 traps are part of AB-650 access. Unlock AB-650.