Role to assign the Fabrikam helpdesk users for contoso.com:
Password Administrator

This role allows users to reset passwords for non-administrative accounts in the directory, aligning with the principle of least privilege.
To restrict the scope of the role assignments for the Fabrikam helpdesk users, use:
An administrative unit

Administrative units allow you to scope role assignments to specific subsets of users or resources, ensuring access is limited to only the required accounts at Contoso.
Role to assign to the Fabrikam helpdesk users to reset the Contoso user passwords:
Password Administrator

The Password Administrator role is specifically designed for resetting passwords for non-administrative users.