Windows AD Service Account minimum privileged for Fortinet SSO

What are the Windows AD Service Account minimum privileges for the Fortinet SSO user account I must assign in the Windows Active Directory Domain Controller?

Granting the overly privileged Domain Admins group to a service account is not permitted due to best practices and the security policies enforced by the security team.