A deployment administrator with Contributor on the target resource group creates the pool, VMs and application group successfully. The portal’s user-assignment step fails with an authorization error. What permission is missing for that step?

✓ Correct answer

• Microsoft.Authorization/roleAssignments/write at the appropriate application-group scope or a containing scope.

Contributor does not grant permission to assign Azure RBAC roles. Add only the appropriately scoped role-assignment authorization needed for the portal assignment step. Option explanations: A. The user’s own Virtual Machine User Login role on a deployment VM.: End-user guest login rights do not grant the administrator role-assignment permission. B. Microsoft.Compute/virtualMachines/write on the same resource group.: The successful VM deployment already demonstrates compute-write permission; it does not grant role assignment. C. Microsoft.Authorization/roleAssignments/write at the appropriate application-group scope or a containing scope.: Creating a user assignment requires permission to write the Azure role assignment. D. Microsoft.DesktopVirtualization/hostPools/write on the created host pool.: Pool configuration permissions do not imply authorization to assign RBAC roles. Sources: Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop

Read the source reference