A platform team governs 40 subscriptions that all sit under a single management group. The network operations team needs to create and modify route tables, network security groups, and virtual network peerings anywhere in that estate, and to read every other resource type. The design must also ensure that:
- the network operations team cannot delete a virtual network, - the permission set is defined once and is assignable across all 40 subscriptions, including subscriptions added later, - the team is granted nothing beyond what it needs.