what all access is needed to perform this at service principal level ?