You have an Azure subscription named Subcription1 that contains an Azure Active Directory (Azure AD) tenant named contoso.com and a resource group named RG1. You create a custom role named Role1 for contoso.com. Where you can use Role1 for permission delegation?