A regional help desk should manage eligible user properties only for employees in its division. Which TWO configuration steps fit? Select TWO.

1. Assign only Azure Reader on an unrelated resource group
2. Assign Global Administrator to every help-desk employee
3. Define an administrative unit containing the intended users
4. Assign an appropriate supported role at that administrative-unit scope