Explanation: Global administrator. Only the global administrator can manage groups across tenants and assign other administrator roles.