An organization adds a custom domain to Entra ID. What must it generally do before using the domain as a verified tenant domain?

1. Change the Azure subscription display name
2. Invite a guest with any address in the domain and assume ownership
3. Assign every user Global Administrator
4. Prove domain ownership using the required DNS verification record