Find the role.
Grant less.

Search an administrator task or role name. See what the role can do, what it cannot do, the least-privilege fit, and how to approach PIM assignment.