We have a requirement to allow VMSS instance boot diagnostics to the set of admins for which we created a custom role with restricted permissions. However, upon our tested we fo