To enable additional security for the Work 365 Service Account without enabling System Administrator permissions to the service account, the Field Security Profile must be assigned to the Service Account. In addition, CRM users looking to have Work 365 Admin permissions without having the security role assigned, can also have the Field Security Profile added to their user in CRM. 

For this go to CRM Settings > Advanced Settings > Security > Field Security Profiles > Select Work 365 Admin

A pop up will open. Click on Users.

Click on Add.

 Search for the Work 365 Service Account (other CRM users can also be selected to enable Work 365 Admin permissions without assigning the Admin security role) and Select it. Then click on Add.

This will add the user to the Work 365 Admin account and give it the appropriate permissions.