Subscription1 contains VNet1 in RG1. User1 has Reader, Security Admin, and Security Reader roles. To allow User1 to grant the Reader role on VNet1 to others, which action is required?

The User Access Administrator role is specifically designed to manage user access to Azure resources. Assigning this role to User1 for VNet1 grants them the permission to assign or revoke roles on that particular resource. The Reader, Security Admin, and Security Reader roles do not include permissions to manage role assignments. While the Contributor role allows managing resources, it does not inherently grant the ability to manage role assignments for other users. Removing User1 from existing roles or assigning Contributor to RG1 would not provide the necessary permissions to manage access on VNet1.