Your organization deploys a pooled AVD host pool. The service desk team must be able to start, restart, and shut down individual session host VMs in the resource group that contains them, but they must NOT be able to modify VM configuration, resize VMs, delete VMs, or change any AVD host pool objects. You want to follow the principle of least privilege using built-in Azure roles. Which role assignment should you grant the service desk team on the resource group containing the session host VMs?