Which built-in role should be assigned to give interns read-only access when defining RBAC policies?

The Reader role provides read-only access to Azure resources, which is ideal for interns who need to view configurations and data without making changes. Contributor allows full access to manage all resources but does not allow assigning roles in Azure RBAC. This is too permissive for a read-only requirement. Owner has full access to manage all resources, including the ability to assign roles, making it far too powerful for an intern. User Access Administrator allows you to manage user access to Azure resources, but not the resources themselves. This is not the primary requirement for viewing resources.