A PIM user assigned the User Access Administrator role receives authorization errors when managing role assignments. To resolve this, which role should be assigned to the PIM service principal on the subscription, following least privilege?

The PIM service principal requires permissions to manage role assignments on the subscription. The User Access Administrator role grants the ability to manage user access to Azure resources, including assigning and removing roles. Assigning this role to the PIM service principal ensures it has the necessary permissions to elevate and de-elevate user access, which is the core function of PIM. Contributor is too broad, granting full access to manage all resources, which violates the principle of least privilege. Managed Application Operator is for managing managed applications, not role assignments. Resource Policy Contributor is for managing resource policies, not user access. Therefore, User Access Administrator is the most appropriate role, adhering to least privilege while providing the required functionality.