IAM AD SSO least privileges to success

I am checking the User Manual for IAM of the Domain SSO. In the document, it said we have to provide a Domain Admin Account to "obtain login information from the AD server and report the received information to the IAG for implementing SSO".

I am thinking that there should NOT be using Domain Admin privilege (the highest privilege) to perform such an operation. So what is the least privileges to work with the objective, Event Log Readers?

Please help.

"Privileged" accounts and groups in Active Directory are those to which powerful rights, privileges, and permissions are granted that allow them to perform nearly any action in Active Directory and on domain-joined systems.

You can create a simple user other than administrator and give him that privileges.

So what is the least privilege level? Must be Domain Administrator? Or could I use less powerful permission such as Network Operator?

Good day! As long as the user have permission, you may use that user.
You need to grant user with enable remote permission, then in advanced you need to allow for the user to access namespace and subnamespaces. Lastly, assign user to Event Log Readers and Performance Log user in user account active directory.

There are many consequences to provide least privileged to grant it. This is highly recommended from sangfor to use domain administrator or equivalent administrator to use sso.