You have a Microsoft Azure Active Directory (Azure AD) tenant. The organization needs to sign up for Microsoft Store for Business. The solution must use the principle of least privilege. Which role…

The Global administrator role is the most privileged role in Azure AD and Microsoft 365, granting control over all administrative features. Initial setup and configuration tasks for tenant-wide services like Microsoft Store for Business often require this role to establish the service's integration and permissions within the organization's directory.

The Cloud application administrator role can manage all aspects of enterprise applications but typically does not have the broad tenant-level permissions required for signing up for new Microsoft services like Store for Business.

The Application administrator role has more limited permissions than the Cloud application administrator, focusing on enterprise applications, and is insufficient for the initial signup of Microsoft Store for Business.

The Service administrator role is a legacy concept often associated with classic portal roles and does not map directly to the specific Azure AD permissions required for signing up for Microsoft Store for Business under the principle of least privilege.