Subscription1 contains VNet1 in RG1. User1 has Reader, Security Admin, and Security Reader roles. To permit User1 to assign the Reader role on VNet1 to other users, what should you assign?

The User Access Administrator role is required to manage user access to Azure resources, including assigning roles to others. Assigning this role to User1 on VNet1 will grant them the necessary permissions to assign the Reader role for VNet1. The Contributor role allows managing all resources but does not include the ability to assign roles. The Network Contributor role allows managing network resources but also lacks role assignment capabilities. Removing existing roles and assigning Contributor at the subscription level would grant broader permissions than necessary and still wouldn't directly enable role assignment without the User Access Administrator role.