Thanks for the idea David. Unfortunately, when I change the user to the ap-provisioning role, they can no longer see the controllers or the Managed Network. Subsequently, no APs show up to provision or un-provision.
I get the first picture instead of the second one.
ap-provisioning roleroot role