A contractor must view Azure resource settings in one resource group without modifying them. Which access assignment best follows least privilege?

1. Global Administrator in Microsoft Entra ID
2. Reader at that resource group's scope
3. Owner at the subscription scope
4. Contributor at the management group scope