Microsoft Azure Security Engineer Associate AZ-500 Practice Question

The Contributor role allows management of resources but does not permit the assignment of roles to other principals. Granting the Owner role would work, but it provides full access to all resources and would exceed the minimum-privilege requirement. The User Access Administrator role is specifically designed to let a principal manage access to Azure resources without granting any rights to modify those resources themselves. Security Admin and Reader do not include the permission to create role assignments. Therefore, assigning User Access Administrator to User1 satisfies the need to grant role-assignment capability while keeping privileges to the minimum necessary.