To allow User1 to purchase a Microsoft Entra Permissions Management license, you need to grant them the permission to perform billing or purchase operations. Microsoft documentation for Microsoft Entra Permissions Management states that to activate a trial or purchase a license, you must have Billing Administrator permissions. Specifically, under the "Enabling Permissions Management" section, Microsoft says: "Sign in as a Global Administrator ... In the Entra ID portal ... select Microsoft Entra Permissions Management, then select the link to purchase a license or begin a trial." And in the product roles and permissions documentation, Microsoft lists "Billing Administrator" as a built-in role that performs billing related tasks like managing payment information and also mentions that to activate (i.e. purchase) Permissions Management you require Billing Administrator role. Assigning Global Administrator (option D) is too broad and would violate principle of least privilege. Permissions Management Administrator allows managing the product after it's enabled, but doesn't grant purchase rights. User Access Administrator is an Azure role that grants permissions to manage role assignments but not purchase licenses. Thus the minimal correct role is Billing Administrator.