
Explanation:
Sign-in from an anonymous IP address falls into Sign-in risk. This means only members of Group
2 will be affected by Identity Protection.
Box 1: Yes
User1 can log in from any IP as user's IP is not scrutinized. The user is not in scope of Sign-In policy.
Box 2: No
User2 cannot login. This user is in scope of the Sign-In policy and will be challenged to perform MFA. Since MFA is disabled, MFA challenge will be unsuccessful - login fails.
Box 3: Yes
User3 can log in. This is user is also in scope of the Sign-In policy, but since user's MFA is working (hence assuming a successful MFA challenge) the user will be granted access.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks