Azure devops. Self-Hosted pool creation restriction

Hello all.

We'd like to avoid teams to create self-hosted agent pools by themselves. We tried applying the different roles  described https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/pools-queues?view=azure-devops&tabs=yaml%2Cbrowser

but it is not working . There is some configuration/ permission set  we can use to achieve this?

Thanks a lot.