Trying to give techs custom intune role but avoid deleting devices

Hi All,

Having issues creating custom intune roles for tech team to be able to administer intune devices. 

However I dont want them to be able to make or delete policies or groups or devices but do all the standard intune administration especially renaming devices and setting primary users.

I duplicated intune admin role and removed the things I didnt want. I create the custom role and assigned it a group with tech users in it.

However it still doesnt work. Anybody have any idea ? 

Thanks