You have an Azure subscription that is linked to Microsoft Entra tenant named Contoso.com.

You deploy Azure Virtual Desktop $($AVD$)$ session hosts that are joined to Microsoft Entra Domain Services domain named aaddomain.contoso.com.

User$1$ must configure group policy objects and administer computers joined to aaddomain.contoso.com.

You need to provide User$1$ permission to administer the managed domain.

To which role or group should you add User$1?$