A support group must restart virtual machines in one resource group without assigning access to other users. Which built-in role and scope best fit?

1. Owner on the subscription
2. Reader on the resource group
3. User Access Administrator on the resource group
4. Virtual Machine Contributor on the resource group