Anna,

You can grant "Supercopy" permission to a user via a custom Phone Administration role.  Go to User Management>Roles.  Find the role "Standard CCM Phone Management" and copy it to a new role with a name that makes sense in your environment.  In the new role scroll/page down until you find the resource called "Super Copy Info".  Grant Read/Write access by checking the boxes (see image attached).

Assing the new role to a custom group.  If you need to create a new group, you can copy the standard CCM Phone management group and thne remove the Standard CCM Phone Management role.  Replace that role with the new custom role (with Super Copy enabled) and your admin will be able to use that feature.

I believe that the admin will still need the other "standard" permissions provided by the CCM Phone Management group and roles.  After copying an existing phone, they will need standard phone permissions to edit lines, mac addresses, descriptiong fields, etc.

I am with you on being conservative on level of access.  I recommend that when you setup a new user group/role relationship that you use a test user (you can use an Application User if that makes sense in your environment, i.e. coordinating with AD/LDAP folks to create a user when you are DirSync-enabled may be annoyingly slow).  With your test user, scroll through the admin screens and make sure that the test account can only do what you expect they should.  Tweak as necessary.

HTH.

Regards,
Bill

Please remember to rate helpful posts.