@JJ-Fullmer
In our environment we just use a service account that has delegated rights to create / delete computer objects and domain join, it doesn’t have access to anything else. No need for domain admin in that case.