A migration team needs to deploy SAP infrastructure, but should not manage identities across the tenant. Which access approach fits?

1. Disable authorization during the migration
2. Grant permanent global administrator to every engineer
3. Assign required deployment roles at the appropriate subscription or resource-group scope
4. Share the subscription owner's credentials