There are also two settings that your AAD administrator can set globally that caused us some problems. Users can register applications - this needs to be on for a plain-old user (owner or not) to be able to create an App or SP Restrict access to Azure AD administration portal - this needs to be on to allow Azure portal users to see the AAD (for diagnosing permission problems)