You need to assign a user named User1 permission to add and delete records from the contoso.com zone only
You need to identify which Group Policy object (GPO) name prefix must be used for IPAM Group Policies