Your company has multiple departments and one Azure subscription. The user accounts for all employees are in the same Microsoft Entra tenant. You need to delegate permissions for the users in a single department only. What should you use to organize the user accounts?