QuickKart is into retail market and they have migrated thier workload to azure. How can QuickKart allow some users to control the virtual machines in each environment but prevent them from modifying networking and other resources in the same resource group or Azure subscription?

Create a role assignment through Azure role$-$based access Oontrol $($Azure RBAC$).$

Create a policy in Azure Policy that audits resource usage.

Split the environment into separate resource groups.