Examkin

Question

Difficulty: HardSelf-Service Password Reset and External Identities

Your company has a Microsoft Entra ID tenant named contoso.com. The tenant contains 500 internal users who are all assigned Microsoft Entra ID P1 licenses, and 100 guest users invited from an external partner organization via B2B collaboration. You configure Self-Service Password Reset (SSPR) for the tenant and set the Enablement setting to Selected, pointing the policy to a security group named Contoso-SSPR. You configure the following group membership and user assignments: User1 is an internal user with a Microsoft Entra ID P1 license and is added as a direct member of Contoso-SSPR. GroupA is added as a member of Contoso-SSPR. User2 is an internal user with a Microsoft Entra ID P1 license and is a member of GroupA (making User2 a nested member of Contoso-SSPR). User3 is a guest user invited via B2B collaboration and is added as a direct member of Contoso-SSPR. Which of the users can reset their passwords by using the contoso.com SSPR policy?

  1. User1 onlyAnswer
  2. B
    User1 and User2 only
  3. C
    User1 and User3 only
  4. D
    User1, User2, and User3

Answer

User1 only
Only the direct member of the SSPR-scoped group (User1) is eligible to reset their password using the Contoso SSPR policy. SSPR settings do not apply to nested group members (User2), and external B2B guest users (User3) must reset passwords through their home identity provider.

Step-by-Step Solution

1
Understand how SSPR scope configuration handles group nesting.
SSPR enabled for a 'Selected' group applies only to direct members of that group; it does not support nested groups.
Microsoft Entra ID SSPR policy evaluation does not traverse nested groups to determine who is enabled.
2
Analyze the behavior of SSPR for external B2B guest users.
Guest users (B2B collaboration) manage their passwords at their home identity provider, not via the resource tenant's SSPR policy.
The home tenant or external identity provider holds the authority for authentication credentials and password reset workflows.
3
Evaluate the capability of each user based on these rules.
User1 is a direct member and can use SSPR. User2 is in a nested group and cannot use SSPR. User3 is a guest user and cannot use SSPR.
Only direct members with appropriate licensing are eligible under the 'Selected' SSPR configuration.

Key Concept

Self-Service Password Reset (SSPR) group scoping constraints and B2B external identity authentication boundaries.
Rate this question

Topics

Self-Service Password Reset and External Identities

More questions from this topic