You have a large Microsoft Entra ID tenant with 10,000 users. You need to delegate the ability to reset passwords for users in the 'Seattle' office to a local IT lead, without granting them administrative rights over users in other offices. What should you create?