Explanation:

According to the Microsoft Identity and Access Administrator (SC-300) Official Study Guide and Microsoft Entra documentation , role assignments in Entra ID (formerly Azure AD) can be scoped at directory (tenant- wide) or administrative unit (AU) levels.
An Administrative Unit (AU) is a logical grouping of Azure AD resources (users, groups, devices) that allows administrators to delegate management responsibilities. When you assign roles scoped to an AU, the permissions of the role apply only to objects within that AU.
From Microsoft's "Manage role-based access control (RBAC) with administrative units" module:
"You can assign directory roles to users either at the tenant level or scoped to an administrative unit. Only users who are members of the AU can be assigned roles scoped to that AU." Applying this to the scenario:
* User1 is a member of AU1. Therefore, User1 is eligible for a role assignment scoped to AU1 and/or tenant-wide (contoso.com). User1 can have the Security Administrator role assigned at both AU1 and contoso.com.
* User2 is not a member of AU1. Users who are not members of an administrative unit cannot be assigned roles scoped to that AU. Thus, User2's User Administrator role can be assigned only at the tenant-wide (contoso.com) level.
This aligns with the Microsoft Learn reference:
"Only members of an administrative unit can be assigned directory roles scoped to that administrative unit.
Roles can always be assigned at the organization level regardless of AU membership."