Examkin

Question

Difficulty: EasySelf-Service Password Reset and External Identities

You manage a Microsoft Entra ID tenant. You configure the Self-Service Password Reset (SSPR) policy and set the enablement scope to a group named SSPR-Users. A user who is a direct member of the SSPR-Users group attempts to reset their password but receives an error indicating that they cannot reset their password. Which of the following is the most likely cause of this issue?

  1. A
    The user is a member of an Administrative Unit, which overrides and blocks the tenant-wide SSPR group enablement.
  2. B
    The SSPR-Users group is configured as a dynamic group, and SSPR policy group scoping only supports manually assigned groups.
  3. The user has not registered the minimum number of authentication methods required by the SSPR policy.Answer
  4. D
    The user is assigned the Owner role for an Azure subscription, which automatically bypasses the Entra ID SSPR policy.

Answer

The user has not registered the minimum number of authentication methods required by the SSPR policy.
The correct answer is correct because Microsoft Entra ID requires users to register the required number of enabled authentication methods (such as email, mobile app, or phone) before they can perform a self-service password reset. Even if SSPR is enabled for their group, they cannot reset their password without this registration.

Step-by-Step Solution

1
Identify the SSPR enablement scope and group membership.
The user is in the group SSPR-Users, which is scoped for SSPR, meaning they are permitted to use SSPR.
To determine if the user is authorized by policy to use SSPR.
2
Check for registration requirements.
A user must have registered the required authentication methods before they can perform a reset.
SSPR cannot function if there is no registered method to verify the user's identity.
3
Evaluate misconceptions regarding group type, administrative units, and subscription roles.
Dynamic groups are supported; Administrative Units do not block tenant SSPR; Azure RBAC subscription roles do not bypass Entra ID tenant policies.
To rule out the other options as incorrect configurations or unrelated scopes.

Key Concept

Self-Service Password Reset (SSPR) registration requirements
Estimated Time:1m 0s
Rate this question

Topics

Self-Service Password Reset and External Identities

More questions from this topic