You have an Azure subscription that use Microsoft Defender for Cloud and contains a user...

In Microsoft Defender for Cloud’s role-based access model, specific Azure built-in roles define what users can view and configure:

Security Reader: View-only access to Defender for Cloud recommendations and alerts.

Security Operator: Can view and dismiss alerts but cannot modify security policies.

Security Admin: Can view everything a reader can and additionally edit security policies, manage recommendations, and configure settings across Defender for Cloud.

Owner/Contributor: Have broader Azure resource management rights, exceeding what’s required to manage Defender for Cloud policies—violating the principle of least privilege.

The principle of least privilege dictates assigning the narrowest role that allows performing the required tasks. In this case, the Security Admin role is explicitly documented by Microsoft as granting permission to modify security policies and settings in Defender for Cloud, without granting full subscription ownership rights.

Therefore, to allow User1 to modify Defender for Cloud security policies while maintaining least privilege:

✅ Assign the Security Admin role.