The SC-300 coverage of Azure AD Connect explains that when you need to bring in a new set of on-premises users or change what is synchronized (for example, adding an additional domain/OU such as ADatum or adjusting filtering), you reopen the Azure AD Connect wizard and choose "Customize synchronization options." The guide notes that this path lets you "modify directory/OU filtering, add or remove forests, and enable optional sync features" so that only the intended users are synchronized. It contrasts with operational commands: Start-ADSyncSyncCycle merely triggers an immediate delta/full sync of the current configuration; Set-ADSyncScheduler changes the sync cadence or pause/resume behavior; and "Change user sign-in" alters the authentication method (e.g., PHS vs. PTA) but does not control scoping of which users are synced. To meet a requirement to sync the ADatum users according to technical constraints (such as OU
/domain selection or feature toggles), you must first configure the scope by running the wizard and selecting Customize synchronization options, then perform/allow a sync cycle to bring those users into Azure AD as defined.

In Azure AD, license automation is implemented through group-based licensing . The SC-300 materials explain that "you can assign licenses to a group in Azure Active Directory; when you assign a license to a group, all users who are members of the group are assigned that license" . They also clarify that "dynamic group membership uses rules to automatically add or remove users based on user attributes" , which is the recommended way to on-board new populations without manual effort. For licensing, the guide is explicit that
"group-based licensing works with security groups and Microsoft 365 Groups" and that "distribution lists are not supported for license assignment" . Administrative Units are described as "a scoping mechanism for delegating administrative permissions to subsets of users and devices" , not a licensing entity. Likewise, Organizational Units (OUs) are on-premises AD containers and "do not control license assignment in Azure AD" .
Given the requirement to allocate licenses automatically to new A. Datum users as they appear, the least- effort, policy-driven approach is to create an Azure AD Dynamic User security group with a membership rule that targets those users (for example, by domain, company attribute, or a synced attribute), then assign the required Microsoft 365/Azure AD licenses to that group. As the documentation notes, "when users join or leave the group based on the rule, licenses are added or removed automatically."

Device1 on Nov 16, 2020: Yes
Device3 on Dec 15, 2020: Yes
Device3 on Nov 20, 2020: No
According to Microsoft's official documentation and SC-300: Identity and Access Administrator Study Guide (Identity Governance and Compliance section), Terms of Use (ToU) in Azure Active Directory are managed under Conditional Access policies and enforce user acknowledgment before granting access to resources.
Key configuration settings from the scenario:
* Require users to expand the terms of use: On # Users must open the document before accepting.
* Require users to consent on every device: On # Each device requires a separate acceptance (consent stored per device).
* Expire consents: On
* Expire starting on: December 10, 2020
* Frequency: Monthly # Users must reaccept terms every month after initial consent.
Given that:
* Terms1 was created on November 5, 2020.
* User1 accepted the terms on November 15, 2020 on Device3 only.
* Acceptance is per device, meaning Device1 and Device2 do not yet have acceptance recorded.
Therefore:
* On November 16, 2020 (next day), when User1 signs in from Device1, they must accept Terms1 # Yes.
* The terms expire monthly starting December 10, 2020, so by December 15, 2020, User1 must reaccept the terms on Device3 # Yes.
* November 20, 2020 is still within the same month of initial acceptance (November 15), and terms have not expired yet # No, reacceptance is not required that soon.
This aligns with Microsoft documentation excerpt:
"When 'Require users to consent on every device' is enabled, each unique device sign-in requires separate consent. When expiration is configured, users must reaccept terms based on the defined frequency starting from the specified date."

Conditional Access policies evaluate Assignments (users, cloud apps), optional Conditions , and then enforce Access controls . In SC-300, Terms of use (ToU) is enforced via Grant controls : the policy must " require terms of use " so that users must accept a specified ToU before access is granted. The documentation states that the ToU experience is applied when a policy includes the control to " require terms of use ," and this control lives under the Grant section (alongside controls like require MFA, require compliant device, etc.). Therefore, to deploy Terms1 with Policy1 , configure the Grant controls and select Require terms of use and choose Terms1 . Conditions or Session settings do not trigger ToU acceptance; they refine when or how access is permitted. Target resources select apps, but the enforcement of acceptance is strictly a Grant control.

According to the Microsoft SC-300 Study Guide and Microsoft Learn module: "Implement and manage Microsoft Entra multifactor authentication (MFA)" , suspicious MFA requests can be automatically acted upon by enabling Fraud Alerts under the MFA configuration, not by configuring the Notifications settings .
The Notifications settings only allow administrators to receive alerts when specific events occur, such as account lockouts or configuration changes, but they do not automatically block users who report fraudulent sign-ins.
To automatically block a user who reports an uninitiated MFA prompt, you must enable the Fraud Alert configuration within MFA settings. Specifically, you must set the option "Automatically block users who report fraud" to Yes . This ensures that when a user denies a fraudulent MFA request in the Authenticator app, their account is automatically blocked pending administrator review.
The Exam Ref SC-300 confirms:
"Fraud alerts in MFA allow users to report suspicious MFA requests, and administrators can configure automatic blocking to protect accounts."