Subscription1 and RG1 have the following role assignments: User1 is Network Contributor at the subscription level, and User2 is Contributor for RG1. A policy requiring removal of external accounts with write permissions is assigned to both Subscription1 and RG1. What is the compliance state for each policy assignment?

The policy requiring removal of external accounts with write permissions will evaluate the existing role assignments. User1 is a Network Contributor at the subscription level, which grants write permissions. Since the policy is assigned to Subscription1, it will detect User1's write permissions and mark the Subscription1 policy assignment as Non-compliant. User2 is a Contributor for RG1, also granting write permissions. Because the policy is assigned to RG1, it will detect User2's write permissions and mark the RG1 policy assignment as Non-compliant. Therefore, both policy assignments are Non-compliant because an external account with write permissions exists within the scope of each assignment.