Examkin

Question

Difficulty: MediumSelf-Service Password Reset and External Identities

Your company has a Microsoft Entra ID tenant. You configure Self-Service Password Reset (SSPR) with the following settings:
- Enabled: Selected (Group: Sales-Group)
- Number of methods required to reset: 2
- Methods available to users: Email, Mobile app notification, Mobile phone

Sales-Group has the following members:
- User1 (direct member)
- User2 (direct member)
- GroupB (nested member; GroupB contains User3)

The users have registered the following authentication contact info:
- User1: Email only
- User2: Mobile phone and Email
- User3: Mobile phone, Email, and Mobile app notification

In the External Collaboration settings, "Guest invite restrictions" is configured to "Only users assigned to specific admin roles can invite guest users".

Which of the following statements are correct? (Select two.)

  1. User2 can successfully reset their password using self-service password reset.Answer
  2. User3 cannot use self-service password reset because Microsoft Entra ID does not support nested group membership for SSPR scoping.Answer
  3. C
    User1 can successfully reset their password using only their email address.
  4. D
    User3 can successfully reset their password because they are a member of GroupB and have registered three authentication methods.
  5. E
    A user who is a member of Sales-Group and has the Owner role on an Azure subscription can invite external guest users.

Answer

User2 can successfully reset their password, and User3 cannot use SSPR because Microsoft Entra ID does not support nested group membership for SSPR scoping.
The correct options are that User2 can reset their password because they are a direct member of the scoped group and have registered the required number of authentication methods, and User3 cannot reset their password because Microsoft Entra ID does not support nested group membership for SSPR scoping.

Step-by-Step Solution

1
Determine SSPR scoping eligibility for each user.
User1 and User2 are direct members of Sales-Group, so SSPR is enabled for them. User3 is a member of GroupB, which is nested inside Sales-Group. SSPR group scoping does not support nested groups, so SSPR is not enabled for User3.
SSPR scoping via the 'Selected' option only applies to direct members of the chosen group.
2
Verify if the eligible users meet the SSPR authentication methods requirement.
The SSPR policy requires two methods. User1 has only registered one method (Email) and cannot reset their password. User2 has registered two methods (Mobile phone and Email) and can reset their password.
Users must register at least the minimum number of authentication methods required by the active SSPR policy.
3
Analyze B2B external invitation restrictions against RBAC permissions.
Since guest invite restrictions are set to 'Only users assigned to specific admin roles can invite guest users', standard member users (even those with Azure Subscription Owner RBAC roles) cannot invite guests.
Azure RBAC roles do not grant administrative permissions within Microsoft Entra ID unless directory roles are explicitly assigned.

Key Concept

Microsoft Entra ID SSPR scoping limitations, authentication method requirements, and B2B invitation delegation boundaries.
Rate this question

Topics

Self-Service Password Reset and External Identities

More questions from this topic