In a new Azure AD (now Microsoft Entra ID) tenant, the default multifactor authentication (MFA) method that is automatically enabled is Microsoft Authenticator .
As per the Microsoft Learn module: Implement and manage Microsoft Entra multifactor authentication and Exam Ref SC-300 , the Microsoft Authenticator app is the default and recommended method because it provides the strongest and most phishing-resistant form of MFA compared to SMS or voice calls.
The guide states:
"New Azure AD tenants have Microsoft Authenticator app enabled by default as the primary method for MFA registration and verification. Users are prompted to register the app when MFA is enforced through security defaults or Conditional Access." Other methods such as SMS , voice call , and email OTP are optional and must be explicitly enabled by an administrator.

User1 is eligible for the Application Administrator role and needs to configure an Application Proxy connector group. Application Proxy is an Azure AD feature used to publish on-premises applications securely.
To activate the eligible role, User1 must perform a Privileged Identity Management (PIM) activation within the Azure AD admin center.
From Microsoft Documentation:
"Privileged Identity Management (PIM) role activations are performed in the Azure AD admin center under Azure AD # Privileged Identity Management # My roles." Activation steps are not available through Microsoft 365 or Defender portals.

In the SC-300 materials covering Azure AD MFA configuration, Microsoft distinguishes between Notifications (which control whether the Microsoft Authenticator sends push prompts) and Fraud alert settings (which determine what happens when a user reports an unexpected prompt). The study guide notes that notifications "enable push approvals to the app," but this does not take action when a user reports a suspicious prompt. To satisfy the requirement "block the users automatically when they report an MFA request they didn't initiate," you must use Fraud alert options. The documentation states that administrators can "allow users to submit fraud alerts" and "block users who report fraud" so that "reported accounts are immediately blocked until an administrator unblocks them." These options are part of the tenant's MFA service settings, not the Notifications section. In other words, simply configuring Notifications won't automatically block users who tap Report in Microsoft Authenticator; you must explicitly enable the setting to block users upon fraud reports. Therefore, the proposed solution-changing Notifications settings-does not meet the goal. The correct approach is to enable Fraud alert and select Block users who report fraud, ensuring automatic protection when users report unexpected MFA prompts.

Explanation:
Based on the official Microsoft SC-300 study guide and Microsoft Entra ID (Azure AD) licensing documentation, the licensing requirement for Access Reviews depends on who is being reviewed and how the review is configured .
Access reviews are an Azure AD Premium P2 feature (included in Microsoft 365 E5), and the licensing model specifies that:
"Each user who is part of an access review (either being reviewed or reviewing) must have an Azure AD Premium P2 license, except in cases where guest users are reviewed by internal reviewers - in that case, only the reviewers require a license." Let's analyze each configuration:
* Members: 500 internal + 25 guest users = 525 total members.
* Review Type: Teams + Groups
* Review Scope: All users
* Reviewers: Users review own access
Group1 Since all users (internal and guest) review their own access, every member is considered an active participant in the review. Therefore, each of the 525 members (500 internal + 25 guests) must have an Azure AD Premium P2 license.
# Group1 = 525 licenses required
* Members: 295 internal + 100 guest users = 395 total members.
* Review Type: Teams + Groups
* Review Scope: Guest users only
* Reviewers: Group owner
Group2 Here, only guest users are being reviewed, and the reviewer is the group owner (User2). Since the guest users don't require licenses when being reviewed by an internal reviewer, only the group owner (User2) needs a P2 license.
# Group2 = 1 license required
# According to Microsoft Licensing Guidance (SC-300 Official Content):
"If guest users review their own access, each guest requires a P2 license. If the review is conducted by an internal user (owner or admin), only that reviewer requires the license."

Explanation:

According to the Microsoft SC-300 Study Guide and the official Microsoft Learn module: "Manage user accounts in Microsoft Entra ID", when a user account is deleted from Microsoft Entra ID (formerly Azure AD), the deleted user object is soft-deleted and retained in the Deleted Users container for 30 days.
During this retention period, the user can be restored with all associated attributes, such as group memberships and licenses, unless a permanent (hard) delete is performed before the 30-day period ends. After the 30-day soft-delete retention period expires, the user object and all related data are permanently removed from the tenant and cannot be recovered.
Microsoft documentation states:
"When a user is deleted, the account is retained in a soft-deleted state for 30 days. During that time, an administrator can restore the user from the Azure portal or by using PowerShell." To perform the restoration, the least privileged role that has this permission is the User Administrator.
The User Administrator can:
* Restore deleted users.
* Reset passwords for non-admin users.
* Create, edit, and delete standard user accounts.
Higher-level roles (e.g., Global Administrator or Privileged Role Administrator) also have this ability but are not required - thus, User Administrator is the least privileged appropriate role.