You have an Azure subscription that contains a user named User1. You have an Azure Resource Manager (ARM) template named Template1. You plan to perform the following actions: Deploy an Azure key vault named KV1. Deploy Azure resources by using Template1 to retrieve secrets from KV1. You need to ensure that User1 can deploy Template1. The solution must follow the principle of least privilege. Which parameter should be specified when you create KV1?