Hello!
The way to go would be accessing the policy management option and creating an IAM policy that only grants permission to Maintenance Window creation, something like:
ALLOW settings:objects:read, settings:schemas:read, settings:objects:write WHERE settings:schemaId = "builtin:alerting.maintenance-window";
Then creating a group with that policy and the environment access permission and assigning any user that you only want to let create maintenance windows to that group.
More info if you follow this docs: https://www.dynatrace.com/support/help/how-to-use-dynatrace/user-management-and-sso/manage-groups-an...
Regards,
Álvaro
