The correct action is Export the custom administrative roles as a JSON file from the staging tenant.

Export the custom administrative roles as a JSON file from the staging tenant captures the role definitions exactly so you can import or apply them in the production tenant in a repeatable and auditable way. You can perform the export with Microsoft Graph or Azure AD PowerShell and the JSON contains the unified role definitions including permissions and settings.

Create an administrative unit in the production tenant is incorrect because administrative units are for scoping role assignments and do not provide a mechanism to copy or export role definitions between tenants.

Create the equivalent custom roles directly in the production tenant is not the best first step because manually recreating roles is error prone and time consuming. It is better to export the exact definitions and then import them so permissions and descriptions match exactly.

Run a tenant backup from the staging environment is incorrect because Azure AD does not provide a tenant backup and restore feature that transfers custom role definitions between tenants. Backing up the tenant is not the supported method for moving custom roles.

Full AWS Practitioner Certification Question