IIS or IIS_IUSRS permisions so that PHP can write files for WordPress

I’m running IIS 8 on a virtual machine (Windows Server 2012 Datacenter) in Azure. I have installed WordPress (https://www.microsoft.com/web/gallery/wordpress.aspx) and its dependencies using the Web Platform Installer 4.6

I have trouble when WordPress needs to write files from its admin console. I’ve added the ftp details to the file C:\inetpub\wwwroot\blog\wp-config.php and that works fine. But whenever WordPress tries to write a file from its management web page, for example to create a child theme or to upload media I got an error (e.g. ‘failed to upload due to an error’ or ‘Target child theme directory cannot be created. This is probably a permission error’.)

I can fix this using EvilDr’s idea (https://stackoverflow.com/q/14934006/575530) of adding permissions to the IUSR account. But I am nervous about this since it seems that IUSR and should *only* have access to precisely what it needs; it should never be given access to anything else (https://serverfault.com/a/50132/203196).

Is giving IUSR read Modify, Read & execute, List folder contents, Read, and Write permissions for the WordPress directory C:\inetpub\wwwroot\blog and its subfolders the correct and safest way to get WordPress working on IIS 8?