According to the Microsoft Identity and Access Administrator (SC-300) Official Study Guide and Microsoft Learn documentation on Azure AD roles and permissions , the Cloud Application Administrator role provides privileges to manage applications while enforcing the principle of least privilege.
The scenario requires:
* Preventing User1 from being added as an owner of newly registered apps.
* Allowing User1 to manage Application Proxy settings (used for publishing on-premises apps through Azure AD).
* Allowing User2 to register new applications.
* Application Administrator: Can create and manage all app registrations and enterprise apps, and can add owners - too permissive for this requirement.
* Cloud Application Administrator: Can manage applications, including Application Proxy settings, but cannot assign application owners or grant broad permissions.
* Application Developer: Can only register and manage own applications.
* Service Support Administrator: Provides service health access - not relevant here.
Role Comparison (from Microsoft documentation): Thus, to let User1 manage Application Proxy and prevent assigning ownership of new apps, Cloud Application Administrator is the correct and least-privileged choice.