Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn module "Implement and Manage Microsoft Entra Connect", when organizations need authentication to always validate user passwords directly against the on-premises Active Directory Domain Services (AD DS) environment, the correct configuration is Pass-through Authentication (PTA).
Here's why:
* Pass-through Authentication (PTA) ensures that when a user attempts to sign in to Microsoft Entra ID (formerly Azure AD), their credentials are not validated in the cloud. Instead, the authentication request is securely passed to an on-premises authentication agent, which validates the credentials against the on- premises AD DS domain controller in real time.
* This configuration provides an immediate reflection of on-premises account states - if an account is disabled, locked, or the password is changed, those changes take effect instantly for cloud authentication as well.
To configure PTA, you must use Microsoft Entra Connect, which is the hybrid identity synchronization tool that links on-premises directories to Microsoft Entra ID. During Entra Connect setup, administrators can choose between Password Hash Synchronization, Pass-through Authentication, or Federation as the sign-in method.
Microsoft documentation explicitly states:
"Pass-through Authentication allows users to sign in to both on-premises and cloud-based applications using the same passwords. Authentication occurs against your on-premises Active Directory." Therefore, to meet the requirement that authentication always validates passwords against the on-premises AD DS domain:

Explanation:
User
Can Reset Passwords For
User1
User3 and User5 only
User4
User3 only
According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and official Microsoft Learn documentation on role-based access control (RBAC) and administrative units (AUs) , the scope of administrative privileges determines which users an administrator can manage.
Role Review:
* Password Administrator (Organization scope): Can reset passwords for non-administrators and users with lesser pri vileges across the entire organization. They cannot reset passwords for Global Administrators or users with equal/higher roles.
* Global Reader (Organization scope): Read-only access-cannot perform administrative actions (including password resets).
* Password Administrator (Scoped to AU1): Can reset passwords for users within AU1 who are non- administrators and whose roles are less privileged than their own.
User
Role
Scope
Members in Administrative Unit
User1
Password Administrator
Organization
AU1
User2
Global Reader
Organization
AU1
User3
None
N/A
AU1
User4
Password Administrator
AU1
AU2
User5
None
N/A
None
Step 1 - For User1 (Org-scoped Password Administrator): User1's permissions apply organization-wide, allowing resets for:
* Users without admin roles, including those in or outside any AU.
* Cannot reset passwords for users with equal or higher roles (e.g., Global Reader, Password Administrator).
# Therefore, User1 can reset passwords for:
* User3 (no role, AU1)
* User4 (Password Administrator in AU2) - # cannot reset equal role
* User5 (no role, no AU) #
Final for User1 # User3 and User5 only
Step 2 - For User4 (AU1-scoped Password Administrator): User4's permissions apply only within AU1 and to users with lesser privileges.
Within AU1:
* User1 (Org Password Admin) - # higher privilege
* User2 (Global Reader) - # higher privilege
* User3 (no role) - # can reset
Final for User4 # User3 only

Explanation:

In the SC-300 coverage of Azure AD Connect and Identity Governance, Microsoft explains that to surface a custom on-premises attribute in Azure AD you must enable Directory extensions in Azure AD Connect. The guide states that "Directory extensions lets you synchronize additional attributes from on-premises Active Directory to Azure AD so they are available in the cloud directory for apps and policy." This is the supported way to bring a custom attribute (here, LWLicenses) from the litware.com forest into Azure AD so it can be referenced by cloud features such as dynamic group rules. Domain filtering or optional features do not expose a new attribute to Azure AD; directory extensions does.
For license automation, the SC-300 materials on group-based licensing and dynamic groups emphasize that
"licenses can be assigned to Azure AD groups; group members then inherit the licenses, and when membership changes, licenses are added or removed automatically." They further note that "dynamic user groups evaluate rules against user attributes to add or remove users without manual effort," and that "nested groups are not supported for license inheritance-only direct members receive licenses." Using the synced LWLicenses attribute in a Dynamic User group rule (for example, user.extensionAttribute... -eq "E5") ensures users are automatically added to the correct group and therefore receive the specified licenses without administrative intervention, fully meeting Litware's requirement to "manage the assignment of Azure AD licenses by modifying the value of the LWLicenses attribute."

Reference:
New Microsoft 365/Azure AD tenants enable Security defaults by default. The SC-300 materials emphasize that Security defaults and Conditional Access cannot be used together; to create and enforce custom Conditional Access policies (for example, requiring MFA under specific conditions), you must turn off Security defaults first. After disabling Security defaults, you can define Conditional Access policies that target specific users, apps, locations, or device states, and require controls such as MFA or session restrictions.
Disabling user consent, configuring on-premises password protection, or merely creating an MFA registration policy do not enable Conditional Access; they address different capabilities. Therefore, the first step to control access with Conditional Access is to disable Security defaults.