The tenant admin role must contain groups from the cloud service provider administrators that manage Infrastructure configuration of the vRealize Automation instance.