You will configure Start VM on Connect for three host pools whose session host VMs reside in two different subscriptions. You will use a single Microsoft Entra app registration (service principal) for all pools and want the least privilege required to start VMs. What RBAC assignment should you apply to the service principal?

The Desktop Virtualization Power On Off Contributor role provides the specific permissions needed to start and stop session host VMs, aligning with the least privilege principle. Applying it at the resource group level, where the VMs reside, ensures the service principal only has access to the necessary resources across both subscriptions. Assigning Owner at the subscription level grants excessive permissions. Virtual Machine Contributor on host pool resources is incorrect because host pools don't directly contain VMs; resource groups do. Desktop Virtualization Contributor at the workspace scope is too broad and not directly related to VM power operations. Reader on both subscriptions is insufficient as it only allows viewing resources, not modifying their state.