MDL-35864  Require capabilities to configure and remove enrol/meta