Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com and an Azure Active Directory (Azure AD) domain named contoso.onmicrosoft.com. You are using Role-Based Access Control (RBAC) policies to control who has rights within the Azure subscription. You are a Global Administrator, and have the “owner” built-in role. A member of your team named Mary should be allowed to create and manage all objects in the subscription, but should not be able to add or remove role assignments. You need to give Mary only the rights that she needs. This must be accomplished with the least amount of administrative effort. What should you do?
