When adding a new agent from the agent screen using the Add Office 365 user it grants them global admin unless you select light agent. This seems a bit overzealous. Instead, it should default to agent or allow end user to use the custom option.

Other improvements to this screen could be choosing which department(s) they have access to as well.