To meet the delegation requirements using the principle of least privilege, you should first restrict the general ability of non-administrative users to create applications. This is done by configuring the Allow users to register application tenant-wide setting to 'No'.

Next, to grant this specific capability only to User1, you assign them the Application developer role. This role is specifically designed to allow a user to create and manage the application registrations they own, even when the general tenant setting prohibits it for other users. The Application administrator and Cloud application administrator roles would grant excessive permissions, including the ability to manage all applications in the tenant, which violates the principle of least privilege for this scenario.

Microsoft Entra ID Documentation, Microsoft Entra built-in roles.

Reference: Under the "Application Developer" role description.

Content: "Users in this role can create application registrations when the 'Users can register applications' setting is set to No. This role also grants permission to consent to permissions on behalf of the current user." This directly supports assigning the Application developer role as the correct method for delegation when the general setting is restricted.

Microsoft Entra ID Documentation, Configure user settings in Microsoft Entra ID.

Reference: Section on "Restrict app registration to administrators."

Content: This documentation explains that setting "Users can register applications" to 'No' prevents non-admin users from creating app registrations. It specifies that for a user to register an app in this case, they must be assigned a role that grants the microsoft.directory/applications/create permission, such as Application developer.