Statement 1 (Yes): The terms of use policy Terms1 is configured with "Require users to consent on every device" set to On. Since User1 accepted the terms only on Device3 on November 15, they will be prompted again and must accept the terms when they sign in from a different device, such as Device1, on November 20.

Statement 2 (Yes): The policy is set to "Expire consents" starting on December 10, 2020. This means any consent given before this date becomes invalid. On December 11, which is after the expiration date, User1's previous consent from November 15 will have expired. Therefore, they will be required to re-accept the terms on their next sign-in, regardless of the device.

Statement 3 (No): On December 7, User1's consent on Device3 (given on November 15) is still valid. The consent expiration does not begin until December 10. Because the consent is still active for that specific device, User1 will not be prompted to accept the terms again and therefore cannot accept them.

Microsoft Learn (Azure Active Directory Documentation): Describes the settings for terms of use policies.

Require users to consent on every device: "If you enable this option, users are required to accept the terms of use on each device they access the protected resource from. The user's device must be registered in Azure AD." (Note: While registration is mentioned, the prompt is tied to the sign-in session which enforces the Conditional Access policy containing the ToU).

Expire consents: "If you set this option, you can then specify an expiration schedule... When a user's consent expires, they'll be required to reaccept the terms of use."

Source: Microsoft Learn, Quickstart: Require users to accept terms of use before accessing cloud apps, Sections: "Create terms of use", "View report of who has accepted and declined".