The "backup" role was given write access to the "admin.mms.backup" collection to support the backup service. The backup service, however, is moving away from writing to admin.mms.backup in favor of using the appendOplogNote command, so they no longer need that privilege.