You have an Azure subscription that contains an instance of SQL Server on an Azure virtual machine named VM1 and an Azure Active Directory Domain Services (Azure AD DS) domain that contains two users named User1 and User 2.
On the default instance of SQL Server on VM1, you create a credential named Credential1 for User1.
You need to ensure that User2 can create a SQL Server Agent proxy that will use Credential1.
The solution must use the principle of least privilege.
Which role should you assign to User2?