Azure RBAC roles on a scope (subscription, resource group, resource) can be assigned to Azure AD security principals: users, groups, and service principals (which includes enterprise applications and managed identities). The SC-300 content states: "RBAC roles can be assigned to users, groups, and applications (service principals), including system-assigned managed identities created for Azure resources." In the table, User1 (user), Group1 (security group), VM1 (a VM with system-assigned managed identity), and App1 (an enterprise application service principal) are all valid principals. Therefore, all four can be assigned the Contributor role at the RG1 scope. This enables least-privilege delegation to workloads (VM1/App1) and to people (User1/Group1) without granting broader directory roles.