Intune and the APNs certificate: FAQ and common issues

Hi,

I have query suppose if I create custom roles in Endpoint Manager (Intune). Assign this custom role to Admin account and removed "Intune Administrator" Azure Role with same admin account. Will I able to renew APNS certificate ?

I am aware that I can renew APNS certificate with "Intune Administrator" Azure Role. But just want to understand if there anything permission required from custom role in Endpoint Manager (Intune) ?

While create custom role in Intune on Permissions page I can see "Managed Google Play" and "Microsoft Store for Business" with Modify and Read permission. Just thought if any similar permissions settings exists for APNS ? Or any other page I need to check this ?

I seen most of the MS docs  but not feasible solution. I need to understand this scenario how it get sorted out ?