Which built-in XenDesktop administrator role provides the minimum permissions needed to manage Active Directory computer objects in Citrix Studio?

Full Administrator provides all permissions across the entire XenDesktop site, which far exceeds the minimum permissions needed just to manage AD computer objects.

Host Administrator is scoped to managing hypervisor host connections and resources, and does not include permissions to manage Active Directory computer objects in machine catalogs.

Delivery Group Administrator manages delivery groups and their application/desktop assignments but does not include the permissions required to manage AD computer objects within machine catalogs.

The Machine Catalog Administrator role in Citrix Studio grants permissions specifically scoped to managing machine catalogs, which includes creating, modifying, and managing Active Directory computer objects associated with those catalogs. It provides the minimum necessary privileges for AD computer object management without granting broader administrative rights over delivery groups or infrastructure.