
Explanation:
The cloud-only users must be able to use SSPR.
Microsoft 365 Business Standard
The hybrid users must be able to use SSPR with password writeback to the domain.
Microsoft Entra ID P1
For cloud-only users, the lowest suitable option in the list is Microsoft 365 Business Standard . Microsoft states that basic SSPR capabilities are available in Microsoft 365 Business Standard or higher, and the licensing comparison shows cloud-only user password reset is supported by Microsoft 365 Business Standard, Business Premium, and Microsoft Entra ID P1 or P2. Since the requirement is only for cloud-only SSPR, assigning a higher Entra ID P1 or P2 license would increase cost unnecessarily.
For hybrid users who must reset passwords with password writeback to the on-premises AD DS domain, the correct minimum license is Microsoft Entra ID P1 . Microsoft's licensing table identifies hybrid user password change or reset with on-premises writeback as supported by Microsoft 365 Business Premium and Microsoft Entra ID P1 or P2, and Microsoft explicitly warns that standalone Microsoft 365 Basic and Standard plans do not support SSPR with on-premises writeback.
Therefore, Business Standard is enough for cloud-only users, while Entra ID P1 is the least-cost dedicated license for hybrid SSPR with writeback. Microsoft Entra ID P2 is unnecessary because risk-based identity protection features are not required.