Explanation:
Box 1: Yes
User1 has the Reader role in the subscription.
The subscription includes the storage account.
User1 will have read access to the storage account.
(For RG1 User1 has the Reader and Data Access role.
User1 has no role at the storage account scope level.)
Note:
The Azure Reader role is a built-in role that grants users read-only access to view Azure resources. This means they can see information about resources, their properties, and configurations, but they cannot make any changes or modifications to those resources.
Box 2: No
User2
User2 has the Contributor role for RG1 only, but not for RG2.
User2 has the Reader role in the subscription.
User2 will not be able to create a virtual network in RG2.
Box 3: Yes
User3 has the User Access Administrator role for the storage1storage account.
The User Access Administrator role can assign roles. This role is specifically designed to manage access to Azure resources, including assigning roles to other users, groups, or service principals.
Reference:
https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal