1 of 2

It must have Replicate Directory Changes permission on the domain with which you’ll synchronize.

The Replicate Directory Changes permission allows an account to query for the changes in the directory. This permission does not allow an account to make any changes in the directory.

Grant Active Directory Domain Services permissions for profile synchronization in SharePoint Server 2013