Subscription1 contains VNet1 in RG1 and User1 has Reader, Security Admin, and Security Reader roles at the subscription. What change lets User1 assign the Reader role on VNet1 to others?

The User Access Administrator role grants permission to manage user access to Azure resources, including assigning roles. By assigning User1 this role on VNet1, they gain the necessary permissions to assign the Reader role to others for that specific resource. The Reader, Security Admin, and Security Reader roles do not include permissions to assign roles. Removing User1 from existing roles and assigning Contributor at the subscription or resource group level would grant broader permissions than necessary. The Network Contributor role allows managing network resources but not assigning roles.