A developer can create virtual machines in a resource group but receives authorization errors when assigning Azure roles. Which additional permission is specifically needed?

1. A role that permits role-assignment writes at the target scope
2. A public IP address on the VM
3. A larger virtual machine size
4. Reader on the subscription