We would like the ability to allow a restricted user such as a Helpdesk rep to be able to create EUMR subscriptions. We only want specific subscriptions as we have a lot of addresses that aren't actively monitored so wouldn't necessarily want them to be auto created on sync.
The only way to grant this permission currently however is to provide full access to the policy configuration.