Craig Brookes I'm assuming this user will be used to access the keycloak web console with just access to the realm specified?

My only concern with this is that it may cause a problem with binding to a different realm that's what's used in provision as this user would not have access to that. It will also not have access to creation of another realm.