The Roles are configured in the Management Portal under the Administration | Configuration | Roles tab.
Members of the Domain Admins group will always have the Administration Role assigned; regardless of what group is specified in the configuration tab for the Administration Role.
Full detail regarding Role configuration can be found in the Defender Administration Guide.
It is important to note that the Roles configured within the Management Portal are separate from the Roles that are delegated via the Active Directory Users and Computers Wizard. The Management Portal Roles determine only which sections of the Management Portal a user will be able to utilize; not what abilities they will have to manage Defender within Active Directory Users and Computers.