Explanation:
Box 1: A system-assigned managed identity
Ensure that if Automation1 is deleted, the permissions granted for Vault1 will be removed automatically When an Azure resource with a system-assigned managed identity is deleted, the managed identity is also automatically deleted. This ensures that the identity is not orphaned and that the resource is no longer able to use it. The deletion is tied directly to the lifecycle of the resource, meaning if the resource is gone, so is the associated managed identity.
Box 2: Key Vault Secrets User
Ensure that runbooks created in Automation1 can read secret values stored in Vault1.
To read Azure Key Vault secrets, you'll need to assign the Key Vault Secrets User role. This role grants the necessary permissions to access and use the secrets stored in Key Vault. The Key Vault Reader role also allows users to read metadata of Key Vaults, but not the secret contents themselves.
* Key Vault Secrets User
Read secret contents including secret portion of a certificate with private key. Only works for key vaults that use the 'Azure role-based access control' permission model.
Reference:
https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview
https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guid

Explanation:
Box 1: Yes
User1 has the Reader role in the subscription.
The subscription includes the storage account.
User1 will have read access to the storage account.
(For RG1 User1 has the Reader and Data Access role.
User1 has no role at the storage account scope level.)
Note:
The Azure Reader role is a built-in role that grants users read-only access to view Azure resources. This means they can see information about resources, their properties, and configurations, but they cannot make any changes or modifications to those resources.
Box 2: No
User2
User2 has the Contributor role for RG1 only, but not for RG2.
User2 has the Reader role in the subscription.
User2 will not be able to create a virtual network in RG2.
Box 3: Yes
User3 has the User Access Administrator role for the storage1storage account.
The User Access Administrator role can assign roles. This role is specifically designed to manage access to Azure resources, including assigning roles to other users, groups, or service principals.
Reference:
https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

The following authentication methods are available for SSPR (self-service password reset)
- app notification
- Mobile app code
- Email
- Mobile phone
- Office phone (available only for tenants with paid subscriptions)
- Security questions
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks

Explanation