Posture check: Azure Custom subscription administrator roles found
Query: ```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-role-definition' AND json.rule = properties.permissions[*].actions any start with "*" and properties.permissions[*].actions any end with "*" and properties.type equal ignore case "CustomRole" and properties.assignableScopes starts with "/subscriptions" and properties.assignableScopes does not contain "resourceGroups"```