A grain-elevator cooperative wants a security engineer to assign Virtual Machine Contributor at a resource group without making that person a subscription Owner. Which built-in Azure role can create that role assignment?
Select an answer to reveal the explanation.
Short Explanation
Contributor can wrench on resources all day and still cannot hand out badges. User Access Administrator (or Owner, or Role Based Access Control Administrator) is the badge printer—assign that at the resource group so the engineer can grant Virtual Machine Contributor without becoming subscription Owner.
Full Explanation
Creating Azure role assignments requires Microsoft.Authorization/roleAssignments/write. Owner, User Access Administrator, and Role Based Access Control Administrator include that capability; Contributor does not. Scoping User Access Administrator to the resource group meets least privilege without granting subscription Owner.