I want to have my QA team do some load testing of the dev slot of our web app. I want to give them full administrative access to the dev slot app service and its associated SQL Database and BLOB Storage. I do not want them to have any administrative access to anything else. (I trust them, but people sometimes click the wrong button.)

Is there a way to do this? And if so, how.

Also, if the answer is to put it in a distinct subscription, can I swap the app service instance between subscriptions.