Based on the Microsoft SC-300: Identity and Access Administrator Official Study Guide and Microsoft Learn module "Manage access reviews in Azure AD" , when creating an access review with the setting Reviewers: Members (self) , each user who is a member of the target group is only allowed to review their own access , not the access of others.
Here's how the logic applies in this scenario:
* The scope of the access review is set to Everyone , meaning both internal members and external (guest) users within Group1 will be included in the review.
* The reviewers option is configured as Members (self) - this setting instructs Azure AD to send review tasks to each user so they can attest to their own need for continued group membership.
* Therefore, User3 (a Guest user) will receive the review task to confirm or deny their own access to Group1.
* User1 and User2 , though they are members and User1 is the group owner, wi ll not review User3's access because "Members (self)" does not delegate review authority to other members or owners - it only applies to individual self-assessment.
Microsoft documentation explicitly clarifies:
"When you select Members (self) as the review er type, each user reviews only their own access. Owners or administrators do not approve or deny access on their behalf." Hence, in this scenario, only User3 can perform the access review for their own membership in Group1.

Explanation:
Feature: An MFA registration policy
Grace period: 14 days
According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn documentation under "Plan, implement, and manage multifactor authentication (MFA)" , when an organization wants to require users to register for multi-factor authentication methods (such as Microsoft Authenticator, phone number, or email), this is managed through the MFA registration policy within Azure AD Identity Protection.
This feature is called "Combined security information registration" or MFA registration policy, and it allows administrators to enforce users to register for MFA and Self-Service Password Reset (SSPR). The policy defines which users are required to register and sets a grace period - the amount of time a user can postpone registration after first being prompted.
From the Microsoft official exam reference:
"The MFA registration policy allows users to postpone registration for a defined grace period. The default and maximum supported value is 14 days." During the grace period, users can skip the registration prompt but will be reminded every time they sign in until they complete registration or the grace period expires. Once the 14-day period ends, users must register their authentication methods before accessing resources.
Therefore, based on Microsoft's SC-300 study materials and Azure AD documentation:
* The correct feature used to enforce this is An MFA registration policy.
* The standard and maximum grace period before users must complete registration is 14 days.

Explanation:
User1 must use multifactor authen tication (MFA) when signing in to Microsoft 365 apps. = Yes User2 must use multifactor authentication (MFA) when signing in to Microsoft 365 apps. = Yes User3 must use multifactor authentication (MFA) when signing in to Microsoft 365 apps. = No Compr ehensive and Detailed Explanation with all Microsoft SC-300: Identity and Access Administrator documents : = In Conditional Access, enforcement is determined by Assignments # Users or workload identities (which specify who the policy applies to) and Target resources (which specify what apps/resources are protected).
When a policy's Grant control is set to Require multifactor authentication , all identities included in the policy's user assignment scope must perform MFA when accessing the targeted resources. B eing a member of multiple groups does not weaken enforcement; if a user is in any included group, the policy applies.
Conversely, users not included in the policy's user assignment scope are not prompted by that policy, even if they hold privileged roles. Holding the Global Administrator role does not automatically force MFA unless the tenant uses Security defaults or a Conditional Access policy targets that admin account or its group.
Applying this to the scenario: Policy1 targets All cloud apps (so the ap ps side is universal), and-given the group context-its user assignment is scoped to Group1 . User1 (Group1) and User2 (Group1 and Group2) are both in scope and therefore must perform MFA. User3 is only in Group2 ; since Group2 is not within the policy's user assignment, Policy1 does not apply to User3, despite the Global Administrator role. Hence:
Yes for User1, Yes for User2, and No for User3.