
Explanation:
Box 1: User1 and User3 are
Box 2 : User1 and User4
User 1 - Owner of the subscription. (He can manage any resources in the subscription.) User 2 - Owner of RG2(He can manage any resources in the RG2.) User 3 - Owner of a single VM that is VM1.(he can manage VM1 only) User 4 - Contributor of RG1.(He can manage everything in RG1, even he can delete VMs in RG1.
But cannot change RABC)
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor