The identity must run under the dedicated VMEP User Account