I don't know if it's something specific to our instance or not, but for some reason, we always set Roles = All Roles