You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1…

To allow User1 to assign the Reader role for VNet1 to other users, User1 needs the

Microsoft.Authorization/roleAssignments/write permission for VNet1. The User Access

Administrator role grants this permission. Assigning this role at the VNet1 scope ensures

User1 has the necessary permissions specifically for VNet1, adhering to the principle of

least privilege. The existing roles (Reader, Security Admin, Security Reader) do not grant

permissions to assign roles to other users.

A. Remove User1 from the Security Reader and Reader roles for Subscription1. Removing

roles reduces permissions and does not grant the ability to assign roles.

C. Assign User1 the Network Contributor role for VNet1. The Network Contributor role

allows management of network resources but does not grant permissions to assign roles.

D. Assign User1 the Network Contributor role for RG1. Similar to option C, Network

Contributor does not grant role assignment permissions, regardless of the scope.

Microsoft Learn. (2024). Azure built-in roles. "User Access Administrator" section. Retrieved

from https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#useraccess-administrator

Microsoft Learn. (2024). Azure built-in roles. "Security Admin" section. Retrieved from

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#securityadmin

Microsoft Learn. (2024). Azure built-in roles. "Network Contributor" section. Retrieved from

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#networkcontributor

Microsoft Learn. (2024). Understand Azure role definitions. "Permissions" section. Retrieved

from https://learn.microsoft.com/en-us/azure/role-based-access-control/roledefinitions#permissions (Illustrates the Microsoft.Authorization/roleAssignments/write

permission).