Examkin

Question

Difficulty: MediumSelf-Service Password Reset and External Identities

An administrator of a Microsoft Entra ID tenant configures a Self-Service Password Reset (SSPR) policy. The policy requires two authentication methods for a password reset. The enabled authentication methods in the SSPR policy are:
- Mobile app notification
- Email
- Security questions

Three users in the tenant register the following authentication methods:
- Elena: Registers an email address and configures the Microsoft Authenticator app for notifications.
- David: Registers an email address and a mobile phone number.
- Chloe: Registers a mobile phone number and configures security questions.

Which user or users will be able to successfully perform a self-service password reset?

  1. A
    Elena, David, and Chloe
  2. B
    Elena and David only
  3. Elena onlyAnswer
  4. D
    Elena and Chloe only

Answer

Only the user who registered an email address and configured the Microsoft Authenticator app for notifications is able to perform a password reset.
The SSPR policy requires two valid authentication methods and has enabled only email, mobile app notifications, and security questions. Only the user who registered an email address and configured the Microsoft Authenticator app for notifications has registered two valid methods under this policy.

Step-by-Step Solution

1
Determine the SSPR policy requirements.
The SSPR policy requires two authentication methods to reset a password, and the allowed methods are limited to Mobile app notification, Email, and Security questions.
This establishes the criteria that each user must satisfy to reset their password.
2
Evaluate the first user's registered methods against the policy.
The first user has registered an email and a mobile app for notifications. Both methods are enabled in the SSPR policy, giving her two valid methods.
This satisfies the policy requirement of two valid methods.
3
Evaluate the second and third users' registered methods against the policy.
The second user has only one valid method (email) and one invalid method (mobile phone). The third user has only one valid method (security questions) and one invalid method (mobile phone). Neither meets the requirement of two valid methods.
Mobile phone is not enabled in the tenant's SSPR policy, so it does not count toward the required two methods.

Key Concept

Microsoft Entra ID SSPR authentication method policy enforcement
Rate this question

Topics

Self-Service Password Reset and External Identities

More questions from this topic