Your organization uses custom security attributes in Microsoft Entra ID to tag user accounts with a 'Project' attribute for attribute-based access control. A security analyst who is a member of the Global Reader role reports that they can view most user properties but cannot see the values of the custom security attributes on user profiles. You need to grant the analyst the ability to read custom security attribute values while following least privilege. What should you do?