Exam AZ-720 topic 4 question 36 discussion

B. Instruct the users to change their password in Azure AD. In Azure Active Directory Domain Services (Azure AD DS), password hashes in a format suitable for NT LAN Manager (NTLM) and Kerberos authentication aren't synchronized from Azure AD. These NTLM and Kerberos password hashes are instead created in Azure AD DS when the user changes their password in Azure AD. So, users who were created before Azure AD DS was enabled or those who haven't changed their passwords since Azure AD DS was enabled will not be able to sign in until they change their password. This generates the required password hash for Azure AD DS.

Yup, based on the shared doc, password change should fix this. https://learn.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance#enable-user-accounts-for-azure-ad-ds "For cloud-only user accounts, users must change their passwords before they can use Azure AD DS. This password change process causes the password hashes for Kerberos and NTLM authentication to be generated and stored in Azure AD. The account isn't synchronized from Azure AD to Azure AD DS until the password is changed. Either expire the passwords for all cloud users in the tenant who need to use Azure AD DS, which forces a password change on next sign-in, or instruct cloud users to manually change their passwords."

Based on the link that ADrem has provided, I agree with B.

Answer should be B. More info on: https://learn.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance#enable-user-accounts-for-azure-ad-ds