You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1 has the following roles: Reader Security Admin Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

To allow a user to assign roles to others, they must have the Microsoft.Authorization/roleAssignments/write permission. The User Access Administrator built-in role is specifically designed for this purpose, as it grants permissions to manage user access to Azure resources. Assigning this role to User1 at the scope of VNet1 grants the minimum required permissions to assign the Reader role for that specific resource, following the principle of least privilege. The existing roles assigned to User1 (Reader, Security Admin, Security Reader) do not include the permission to assign roles.

A. Removing roles from User1 will reduce, not add, permissions. This action does not grant the ability to assign roles.
C. The Network Contributor role allows for the management of network resources but does not include permissions to manage role assignments.
D. Assigning the Network Contributor role at a broader scope (the resource group) still does not grant the necessary permissions for role assignment.

1. Microsoft Learn Documentation: Azure built-in roles. This document details the permissions for each built-in role.

User Access Administrator: The description states

"Lets you manage user access to Azure resources." The permissions list for this role includes Microsoft.Authorization/

which contains the necessary Microsoft.Authorization/roleAssignments/write permission.

Network Contributor: The description states

"Lets you manage networks

but not access to them." This role's permissions are scoped to Microsoft.Network/ and do not include Microsoft.Authorization/.

Reference Section: "User Access Administrator" and "Network Contributor" role definitions.

2. Microsoft Learn Documentation: Delegate Azure role assignment management to others. This document explicitly states the requirement for delegating role management.

Reference Section: "Prerequisites". It specifies

"To delegate role assignment management... you must have the Microsoft.Authorization/roleAssignments/write and Microsoft.Authorization/roleAssignments/delete permissions

such as Owner or User Access Administrator." This confirms that User Access Administrator is the appropriate role for the task.