You administer an Azure SQL Managed Instance. A junior DBA needs to be able to create and manage SQL logins at the instance level, but the security team insists the account must NOT be granted full sysadmin-level control over the instance. Which approach grants the required capability while following the principle of least privilege?