Exam AZ-600 topic 3 question 2 discussion

You have a multitenant Azure Stack Hub integrated system for a Cloud Solution Provider (CSP). The integrated system is used by several customers.
You hire a new support technician to help manage the integrated system.
You need to configure access for the support technician. The solution must meet the following requirements:
✑ The technician must be prevented from accessing customer resources.
✑ The technician must be able to monitor the status of infrastructure backups.
✑ The technician must be able to create and manage plans, offers, and quotas.
Which built-in role should you assign to the support technician?