Explanation:

Reference:
In the Administering Windows Server Hybrid Core Infrastructure objectives for managing Azure Arc-enabled servers, Microsoft specifies that onboarding non-Azure machines with the scripted onboarding method requires an Azure AD application/service principal with the least-privileged built-in role expressly created for Arc onboarding. The study guide states that: "For scripted onboarding at scale, create an Azure AD service principal and assign the Azure Connected Machine Onboarding role at the required scope (subscription or resource group). This role grants only the permissions necessary for the connect operation and agent registration; it does not confer general virtual machine management rights." The PowerShell guidance in the same module explains that a service principal can be created and granted a role in one step using New-AzADServicePrincipal, providing a display name and a role assignment: "Use New-AzADServicePrincipal with the -DisplayName parameter to create the application identity and the -Role (and optionally -Scope) parameters to assign the built-in role needed for onboarding." It also contrasts other cmdlets: "New-AzADAppCredential updates credentials for an existing application only; New- AzUserAssignedIdentity creates a managed identity resource and is not used for Arc scripted onboarding." Because the question asks for an identity used by the Azure Arc deployment script and to follow the principle of least privilege, the correct command is to create a service principal and assign the minimal role:New- AzADServicePrincipal -DisplayName 'arc-for-servers' -Role 'Azure Connected Machine Onboarding'.
Other roles such as Virtual Machine Contributor or Virtual Machine User Login exceed what Arc onboarding requires and therefore violate least-privilege guidance.