The correct answer is C. In order for User1 to assign a policy to the tenant root management group, User1 needs to be a Global administrator. Azure AD Global Administrators are the only users who can elevate themselves to gain access to the root management group. Once they have the necessary access, they can assign any Azure role, including policy assignment, to other users. No one is given default access to the root management group, and assigning roles at the subscription level (as suggested in options A and B) does not grant the required permissions at the tenant root management group level. Option D is incorrect because creating a new management group does not address the need for access at the root management group level.