Merge "Allow the device policy management role to migrate accounts" into main