You have an Azure management group named MG1 that contains two subscriptions named Sub1 and...

User Access Administrator is the least-privilege Azure built-in role for managing role assignments without full resource ownership. Assigning it at the MG1 scope covers both Sub1 and Sub2 because management group scope flows down to child subscriptions. Contributor cannot assign Azure roles. Owner would work but grants more than role-assignment authority, violating least privilege. Assigning separately at each subscription adds unnecessary administration. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > manage Azure built-in role assignments; Microsoft Learn > User Access Administrator role.

==============================================================