A service principal needs to deploy resources to a resource group but must not create role assignments. Which role should be assigned?

1. A Owner
2. ✓ B Contributor (correct answer)
3. C Reader
4. D User Access Administrator

Shortcut: Contributor grants full resource management (create, update, delete) but cannot manage access (no role assignments). This follows least-privilege — deploy permissions without access management.