Question about the specification of write permissions

[k.terui]

Hi,

Due to customer constraints, we need to minimize the permissions granted to the Service Account. In this context, we understand that the "Microsoft.Network/virtualNetworks/subnets/write" permission is required. Could you please clarify the following three points regarding this permission?

1. When a Worker subnet already exists and has been pre-provisioned, could you explain why "Microsoft.Network/virtualNetworks/subnets/write" is required during Veeam Worker deployment?
2. For an existing subnet, what specific Azure API operations does Veeam perform, or which subnet properties might Veeam create or update?
3. Could you clarify at what point(s) "Microsoft.Network/virtualNetworks/subnets/write" is actually required?
(For example: only during the initial Worker deployment, during Worker recreation, on every backup run, during restore, when using a different region, when network configuration changes, etc.)