Ensure the Service Account or Override account has the following permissions:
- In the domain that holds Skype for Business Server computers, membership of the RTCUniversalUserAdmins group
- In the user domains, membership of the Account Operators group
- In the shadow accounts domain, membership of the Account Operators group
- For a central forest deployment, the account must also have the rights to create, view, modify and delete contact objects in the shadow accounts domain. It will suffice to make the account a member of the Domain Admins group.
For more details information, please see the Skype for Business Server User Management Administrator Guide.
https://support.oneidentity.com/active-roles/technical-documents