Examkin

Question

Difficulty: MediumSelf-Service Password Reset and External Identities

You manage a Microsoft Entra ID tenant. You configure Self-Service Password Reset (SSPR) with the following settings:

* Self-service password reset enabled: All
* Number of methods required to reset: 1
* Methods available to users: Email, Mobile phone

You have two users in the tenant:

* User1: A standard user who has registered their mobile phone number.
* User2: A user assigned the User Administrator directory role who has registered their mobile phone number.

Both users attempt to reset their password using the SSPR portal.

Which of the following describes the outcome of their password reset attempts?

  1. A
    Both User1 and User2 can successfully reset their passwords because the tenant-wide SSPR policy is set to require only one authentication method.
  2. B
    User1 can successfully reset their password. User2 cannot reset their password because the User Administrator role must be mapped to an Azure RBAC subscription role to inherit SSPR settings.
  3. User1 can successfully reset their password. User2 cannot reset their password because Microsoft Entra ID enforces a two-gate password reset policy for administrator roles.Answer
  4. D
    Neither User1 nor User2 can reset their passwords because SSPR requires a dynamic group membership rule to validate registration states.

Answer

User1 can successfully reset their password. User2 cannot reset their password because Microsoft Entra ID enforces a two-gate password reset policy for administrator roles.
The correct answer is that the standard user can reset their password while the administrator cannot. In Microsoft Entra ID, a default two-gate password reset policy is automatically enforced for all administrator roles, regardless of any custom SSPR settings configured in the portal. Since the administrator has only registered one authentication method, they do not meet the two-gate requirement and are blocked from resetting their password. The standard user is subject to the tenant policy and only needs one method.

Step-by-Step Solution

1
Analyze the SSPR policy for standard users.
Standard users only require one authentication method (either Email or Mobile phone) to reset their password.
The custom SSPR policy is configured with 'Number of methods required to reset' set to 1, and User1 is a standard user who has registered a mobile phone.
2
Analyze the SSPR policy behavior for administrator roles.
Users assigned to Entra ID administrator roles are subject to a default, non-configurable two-gate (two-method) password reset policy.
Microsoft Entra ID enforces a stronger security policy for administrators to prevent unauthorized password resets.
3
Evaluate registration status for the administrator user (User2).
User2 has only registered one method (mobile phone) and thus fails to meet the two-gate requirement.
User2 cannot perform SSPR until they register a second authentication method (e.g., email).

Key Concept

Microsoft Entra ID enforces a default two-gate password reset policy for administrators, which cannot be bypassed by custom tenant-wide SSPR configurations that require fewer methods.
Estimated Time:1m 30s
Rate this question

Topics

Self-Service Password Reset and External Identities

More questions from this topic