You have an azure subscription that contains a user named user1, a resource group named rg1, and a virtual machine named vm1. You enable a system-assigned managed identity for vm1. To which identities can you assign the reports reader role?.