@ayub_siddiquisiddiqui You need to check with organization what operations they want to perform it is mostly dictated by your organization structure. Let me give you an example in one of the customers they want a separate team to deploy Key vaults and separate team who will deploy and configure Network firewall or network components rest all functions can be performed by a single team like storage, VMs etc.
in that case we have a follow the least privilege access so we have to create a custom role editing the contributor role who can do everything except deploying key vaults and Network devices, so it translated to custom role
Contributor (Custom role)
Network contributor (Custom role)
Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics.