You're an Azure administrator for a multinational corporation. You've been tasked with delegating access to a team to manage virtual machines within an Azure subscription but not to modify the networking configurations. Which built-in Azure role should you assign?