Azure Information Protection Administrator Monitor

Hello,

any way to monitor any abuse of AIP administrator? (e.g. access protected document)

any way to separate AIP administrator's role? (e.g. role to manage AIP configurations but no access to protected document/data)

Thanks!!