Released: November 2023 Exchange Server Security Updates

maafraz SUs definitely do not need Enterprise Admin as they do not include schema updates, as you correctly point out. Also note that since 2022, we started to release SUs in a new package (.exe) which will ensure that the admin has the right permissions and will attempt to elevate if needed:

https://techcommunity.microsoft.com/t5/exchange-team-blog/new-exchange-server-security-update-and-hotfix-packaging/ba-p/3301819

Note that even CU updates do not necessarily require Enterprise Admin rights; in fact, you could have a different team run the /prepare switches only and then use a different Exchange Admin account to install the actual CU. More information here: https://learn.microsoft.com/en-us/Exchange/plan-and-deploy/install-cumulative-updates?view=exchserver-2019#what-do-you-need-to-know-before-you-begin

In either case, we always recommend to run the Health Checker after setup is done, as it will tell you if additional steps are needed after CU or SU are set up: https://aka.ms/ExchangeHealthChecker .