Both the creation of a new Organizational Unit (OU) and a new user account within an on-premises Active Directory Domain Services (AD DS) domain are tasks performed using on-premises management tools.

• OU2: An Organizational Unit is a container object that exists only within an on-premises AD DS. Therefore, it must be created and managed using a tool that directly interfaces with the on-premises domain controllers. Active Directory Users and Computers (ADUC) is the standard, long-standing Microsoft Management Console (MMC) snap-in for this purpose.
• User1: Since User1 is being created within an OU in the on-premises domain, its source of authority is the on-premises AD DS. Even if this user will be synchronized to Azure AD later, the initial creation and management of core attributes must happen on-premises. Active Directory Users and Computers is the appropriate tool for creating user accounts in AD DS.

The Azure portal is used for managing cloud-native Azure AD objects, and Azure AD Connect is a synchronization service, not a direct management tool.

Microsoft Learn, Active Directory Users and Computers Documentation: "Active Directory Users and Computers is a Microsoft Management Console (MMC) snap-in that you use to administer Active Directory (AD). You can manage AD objects, such as users, groups, computers, printers, and organizational units (OUs)."

Microsoft Learn, Create a New User Account: This document details the step-by-step process of creating a user account within an on-premises domain, explicitly stating the use of the "Active Directory Users and Computers" tool.

Microsoft Entra ID Documentation, Hybrid Identity: "When you synchronize Active Directory Domain Services (AD DS) to Microsoft Entra ID, you must create and manage users and groups on your on-premises servers. You can't create or manage them directly in Microsoft Entra ID." This confirms that objects originating from on-premises AD DS must be managed using on-premises tools.