Who can do what

• Manage assignments: Privileged Role Administrator and Global Administrator

• View Assignments: Global Administrator, Security Administrator, Global Readers, And Security Readers

• Manage resource roles: Subscription Administrator, Resource Owner and Resource User Access Administrator

• View resource roles: NOT by default by Privileded Role Administrators, Security Administrators or Security Readers

• https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure