Microsoft Azure Security Engineer Associate AZ-500 Practice Question

The User Access Administrator role includes the Microsoft.Authorization/* actions that let a principal read existing role assignments and create, update, or delete role assignments and custom role definitions. Because this role does not grant permissions to create, update, or delete Azure resources, it satisfies the need to manage access without permitting resource modifications. The Owner role would also allow access management but additionally grants full control over all resources, which exceeds the requirement. Contributor allows resource management but cannot grant or revoke access. Reader is limited to read-only actions and cannot change role assignments. Therefore, assigning the User Access Administrator role at the subscription scope is the correct choice.