to update the roster a user only needs the ViewRoster permission