...
add the following permissions
...
...
- Directory.Read.All
- Domain.Read.All
...
- Group.Read.All
- Organization.Read.All
...
- Policy.ReadWrite.AuthenticationMethod
- User.Read.All
...
- UserAuthenticationMethod.
...
- ReadWrite.All
click the "Add permissions" button to save
...