A supported Entra task needs a narrow custom administrative role. Which TWO design decisions support least privilege? Select TWO.

1. Use the narrowest supported assignment scope that meets the task
2. Include every available directory permission for future convenience
3. Treat Azure subscription Owner as an equivalent directory custom role
4. Include only the supported permissions required by the task