Which permission should be granted to a user with Administrator permission and with no access to the encrypted VM console?

Which permission should be granted to a user with Administrator permission and with no access to the encrypted VM console?
A. New role with no Cryptographic Operations
B. Administrator role and Read Only Role
C. Administrator role
D. No Cryptography Administrator role