@maddymontaquila.net *adjust glasses* uhm actually it DOES NOT need owner, "Role Based Access Control Administrator" is more then enough (it will still need "Contributor" to create resources of course) & YES lock it down to recommended so it can't assign dangerous roles (like OWNER) to other people.