Permissions for PasswordNotRequired

I'm want to do some scheduled housekeeping with a GMSA. What permissions do I need to give the account to set the following?

... | Set-ADComputer -PasswordNotRequired $false
... | Set-ADUser -PasswordNotRequired $false