Box 1: A synced user account -

Need to use a synched user account.

Box 2: An access review

https://docs.microsoft.com/en-us/azure/active-directory-domain-services/synchronization https://docs.microsoft.com/en-us/azure/active-direct ory/governance/access-reviews-overview