...

• Create, delete and manage user accounts
• Reset user passwords and force password change at next logon
• Read all user information
• Create, delete and manage groups
• Modify the membership of a group
• Create, delete and manage inetOrgPerson accounts (TODO: is this needed?)
• Reset inetOrgPerson accounts and force password change at next logon (TODO: is this needed?)
• Read all inetOrgPerson information

For LiveSync, you also need "Replicating Directory Changes" permission (please refer to https://support.microsoft.com/en-us/help/303972 and https://support.microsoft.com/en-ae/help/891995/how-to-poll-for-object-attribute-changes-in-active-directory-on-window).

Recommended Connector

Framework: ConnId
Bundle: com.evolveum.polygon.connector-ldap
Version: most recent stable version
Connector: com.evolveum.polygon.connector.ldap.ad.AdLdapConnector

...