To allow User1 to configure contoso.com to use Microsoft Entra Verified ID and to register App1 in contoso.com, which two least-privilege roles should you assign?

To configure Microsoft Entra Verified ID, User1 needs the Authentication Policy Administrator role. This role allows managing authentication methods, including Verified ID settings, and is the least-privilege option for this specific task. The Application Administrator role is required to register App1 in contoso.com. This role grants permissions to create and manage enterprise applications, application registrations, and application proxy settings. The Authentication Administrator role is too broad, as it includes permissions for managing all authentication-related policies and settings, not just Verified ID. Cloud App Security Administrator is irrelevant to both tasks, as it focuses on managing Microsoft Defender for Cloud Apps. User Administrator is incorrect because it focuses on managing user properties and licenses, not application registrations or authentication policies.