Defining a custom role at the `Subscription` or `Management group` scope that
allows all actions will give it the same capabilities as the built-in `Owner`
role.