Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.

 Yes

 Yes

 No

The Administering Windows Server Hybrid Core Infrastructure materials describe how Azure AD Connect filtering and sign-in methods affect user capabilities. Under Domain/OU filtering, it states that when “Sync selected domains and OUs” is configured, only objects in the selected OUs are synchronized to Azure AD. In the exhibit, OU1 is selected and OU2 is not; therefore User1 (in OU1) is synchronized, and User2 (in OU2) is not synchronized and will not exist in Azure AD for group membership.

For sign-in, the guide explains Pass-through Authentication (PTA): “When you enable Pass-through Authentication and disable Password Hash Synchronization, the user’s sign-in to Microsoft 365 is validated against on-premises Active Directory by the PTA agent contacting domain controllers.” Thus, when User1 signs in to Exchange Online, authentication is performed by on-premises AD DS via PTA.

Regarding Self-Service Password Reset (SSPR), the hybrid password management section specifies: “If Password writeback is enabled in Azure AD Connect, synchronized users can reset or change their passwords in Azure AD and the change is written back to on-premises Active Directory.” Because the configuration shows Enable Password writeback and User1 is synchronized, User1 can use SSPR.

Finally, since User2 is not synchronized (OU2 excluded), User2 does not exist in Azure AD and cannot be added to Group1 in the tenant.