
Explanation:
From the table in the question:
* User1-User4 are On-premises (synced) with Password hash authentication.
* User5-User6 are Cloud users ( cloud-only ).
Microsoft's licensing guidance for Self-Service Password Reset (SSPR) scenarios (which includes password change ) states:
* Cloud-only user password change (user knows their password and wants to change it) is available in Microsoft Entra ID Free .
* Exact extract: " Cloud-only user password change ... Microsoft Entra ID Free "
* Hybrid user password change or reset with on-prem writeback (synced from on-prem using Entra Connect and writing the password back) requires Microsoft Entra ID P1 or P2 (or Microsoft 365 Business Premium).
* Exact extract: " Hybrid user password change or reset with on-prem writeback ... Microsoft Entra ID P1 or P2 " Because User1-User4 are synced (hybrid) users and must change passwords using a Microsoft 365 portal and keep passwords consistent with on-premises AD DS, they require password writeback , which requires P1 for those users.
Because User5-User6 are cloud-only users, they can change passwords with Entra ID Free .
Minimum licenses (cost-optimized)
* Microsoft Entra ID P1 licenses: 4 (User1-User4)
* Microsoft Entra ID Free licenses: 2 (User5-User6)