least privilege permissions?

[juju4]

Testing libcloudforensics in Azure, I set up an app registration
https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app
and try different permissions to operate, one for source, one for dest.

Test was on a unique subscription and CreateDiskCopy action

• if subscription owner both for source and destination, works ok
• if one just subscription contributor for either source, either destination nok
• nok if less permission, contributor at resource group or VM level

is it correct assessment?
would it be an azure or libcloudforensics limitations?

while ownership at subscription or better resource group level, would be fine for destination, ideally, the minimum set is used for source.

This would be a great addition to documentation https://libcloudforensics.readthedocs.io/en/latest/usermanual/index.html#microsoft-azure