How to provide privileges to ipa-user to enroll a host in ipa-server

Issue

• How do I provide access to user id so that it can enroll a new host in ipa server?
• Below privileges have been provided but still it is giving error message of insufficient permission when enrolling a host.

add dns entries
add hosts
add krbprincipalname to a host
add user to default group
add users
change a user password
enroll a host
manage host keytab
manage service keytab
modify group membership
modify hosts
read dns entries
remove dns entries
unlock user accounts
update dns entries
write dns configuration