"View-Only Recipients" is the minimum required permission. If you can run a message trace from the Office 365 portal, you can use the same credentials for the add-on. This website details how to run a message trace manually and has more information about the roles necessary -> https://technet.microsoft.com/en-us/library/jj200712(v=exchg.150).aspx :
In order to view the downloaded message trace report, you must have the “View-Only Recipients” RBAC role assigned to your role group. By default, the following role groups have this role assigned: Compliance Management, Help Desk, Hygiene Management, Organization Management, View-Only Organization Management.
