It needs connect, view server state, alter any availability group, and view any definition. No server roles other than public.