The appropriate built-in Azure RBAC role is Monitoring Contributor . Microsoft defines this role for administrators who need to read monitoring information and create or modify monitoring configuration .

Monitoring Contributor includes the monitoring-read capabilities required to inspect metrics and diagnostic data and adds permissions needed to create or edit diagnostic settings, alert-related configurations, and monitoring resources. Microsoft also identifies creation of private monitoring dashboards as a supported use case for this role.

Monitoring Reader is insufficient because it is primarily a read-only monitoring role. It allows users to inspect monitoring data and settings but does not grant the required configuration-modification permissions. The general Reader role similarly lacks write capabilities. Owner would technically provide sufficient access but violates least privilege because it grants comprehensive resource-management permissions, including access-control authority far beyond monitoring.

Because the administrator's duties are specifically monitoring-oriented but require configuration changes, Monitoring Contributor supplies the correct functional scope without granting unrestricted ownership.

Study Guide reference: Secure Oracle AI Database@Azure — Azure RBAC, monitoring permissions, least privilege and operational administration