You can look into below article and check if this answers your question.
https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal
From Defender for cloud, user need to generate the request and request will be forwarded to Global admin and he will approve.
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.