You are the administrator of a newly created Azure tenant on the Azure AD free tier. You have installed and configured AD Connect on an on-premise server, and configured password hash synchronization as your password authentication method. You have synchronized your users to Office 365. You wish to enable your users to reset their own passwords, so you enable the feature "Password writeback" in AD Connect configurations. But users are still not able to reset their own passwords. What must you do next to enable users to change their own passwords?

Answer options:

A.Create a dynamically assigned security group and add your users.
B.Upgrade Azure to a Premium Tier
C.Enable multi-factor authentication (MFA) for your users.
D.Change the “Number of methods required to reset” from 1 to 2.

Correct Answer: B 
Password change is supported in the Free tier, but password reset is not. 
In order to enable the service, you must upgrade to a paid tier. 

Option A is incorrect. A dynamic security group use rules to determine group membership based on user or device properties.
Option C is incorrect. MFA is not required to enable self-service password reset. Your user will however have to register for password reset by going through an authentication method workflow. 
Option D is incorrect. You do not have to change number of methods to 2, although this would improve security.
Reference: 
To know more about Active Directory self-service password reset, please refer to the link below: 

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-licensing