Can User3 create new user accounts in the external Azure Active Directory tenant?

In Azure Active Directory (AAD), user permissions and roles govern the ability to perform various actions, such as creating new user accounts. The ability for an individual to create user accounts in an external Azure Active Directory tenant is primarily dependent on the roles assigned to that user within that specific tenant.

Typically, users need to have specific administrative roles, such as 'User Administrator' or 'Global Administrator', to create new user accounts. If User3 does not have one of these roles in the external tenant, they would not have the necessary permissions to create new accounts. Additionally, external users (users from one AAD tenant accessing another AAD tenant) often have limited privileges and are usually not granted full administrative permissions to manage the resources of that external tenant.

Therefore, without the appropriate roles assigned to User3 in the external Azure Active Directory tenant, User3 would not be able to create new user accounts. This aligns with standard security practices, which restrict access and permissions to ensure that only authorized individuals can perform certain actions in an Azure environment.