Based on the documentation here: https://learn.microsoft.com/en-us/power-platform/alm/devops-build-tools#create-service-principal-and-client-secret-using-powershell, the support engineer and myself conclude that the service principal created has full admin rights on the tenant.

[quote] "This PowerShell script helps creating and configuring the service principal to be used with the Microsoft Power Platform Build Tools tasks. It first registers an Application object and corresponding Service Principal Name (SPN) in AAD.

This application is then added as an administrator user to the Microsoft Power Platform tenant itself."

Since our company is both and ISV partner and a customer, the internal IT department will not provide such as service user. That user (for development/testing purposes) will also be able to administrate (and delete!) environments we're using for production purposes.