A deployment pipeline only needs to manage one application resource group. What permission scope best follows least privilege?

1. Every directory administrator role
2. Public anonymous write access to all resources
3. A suitable deployment role restricted to the required resource group
4. Owner at the tenant root management group for convenience