A SOC analyst is investigating a suspected data-leak incident in Microsoft Defender XDR. As part of the response, the analyst must run a Purview eDiscovery (Standard) content search across the compromised user's Exchange mailbox and OneDrive to identify what documents were accessed, and then export the results for the legal team. The analyst currently only holds the Security Reader role in Microsoft Entra ID and cannot see the eDiscovery search creation option in the Purview portal. What is the MINIMUM change required to allow the analyst to create the content search and export results?