Both Application Security Groups (ASGs) and Azure Bastion are networking resources within Azure.

• Role1 (Application Security Groups): ASGs are used to group virtual machines and define network security policies based on those groups. All management operations for ASGs, such as creating, deleting, or modifying them, are permissions within the Microsoft.Network resource provider. For example, the permission to create an ASG is Microsoft.Network/applicationSecurityGroups/write.
• Role2 (Azure Bastion): Azure Bastion is a platform-managed service that provides secure and seamless RDP/SSH connectivity to virtual machines directly in the Azure portal. Since Bastion is fundamentally a networking service that facilitates secure connections to resources within a virtual network, its management also falls under the Microsoft.Network resource provider. For instance, creating a Bastion host requires the Microsoft.Network/bastionHosts/write permission.

Therefore, Microsoft.Network is the correct resource provider for both custom roles.

Microsoft Official Documentation (Microsoft Learn): "Azure resource providers and types." This document lists the resource types managed by each resource provider. Under the Microsoft.Network provider, you can find applicationSecurityGroups and bastionHosts, confirming that both are managed by this provider.

Microsoft Official Documentation (Microsoft Learn): "Application security groups." In the Permissions section, it states that ASGs are a resource within Microsoft.Network. For example, the built-in Network Contributor role, which can manage ASGs, has its permissions defined under Microsoft.Network/*.

Microsoft Official Documentation (Microsoft Learn): "Working with a custom role." In the tutorial for creating custom roles, examples for networking resources consistently use the Microsoft.Network provider for permissions related to virtual networks, subnets, and associated services like Azure Bastion. The necessary actions for managing Bastion, such as Microsoft.Network/bastionHosts/read, clearly fall under this provider.