A finance auditor needs to inspect Azure resource configuration in one subscription without changing resources or reading every storage object's contents. Which starting assignment best fits?

1. Owner at the tenant root management group
2. Storage Blob Data Owner on every account
3. Contributor on every management group
4. Reader at the subscription scope, with data access granted separately only if required