Modify the password protection policy: User1 only; Invite an external user: User1, User2, User3, and User4

Microsoft Entra ID uses role-based access control (RBAC) to authorize administrative operations. The two activities in this question have different permission requirements.

First selection: User1 only.

Modifying the tenant-wide password protection policy requires privileged authorization. The Global Administrator role held by User1 includes the permissions required to configure Microsoft Entra Password Protection, including the custom banned-password list and smart lockout settings.

The Authentication Policy Administrator role can also manage these settings, but none of the other listed users holds that role. User2 ' s Security Administrator role does not provide this specific permission, while User4 ' s Password Administrator role concerns password administration rather than configuration of the tenant-wide password protection policy.

Second selection: User1, User2, User3, and User4.

Microsoft Entra external collaboration settings allow users to invite external guests. Under the default configuration, organizational users can invite external users, including users without administrative roles.

User1 can invite guests as a Global Administrator, and User2 also has the Guest Inviter role. User3 and User4 can invite external users under the default invitation settings.

Therefore, all four users qualify for the second activity.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure