Examkin

Question

Difficulty: Very hardSelf-Service Password Reset and External Identities

Your company has a Microsoft Entra ID tenant named contoso.com that has Microsoft Entra ID P1 licenses assigned to all users. You configure Self-Service Password Reset (SSPR) for the tenant with the following settings:

* Self-service password reset enabled: Selected
* Select group: Group1
* Number of methods required to reset: 1
* Methods available to users: Email, Security questions

`Group1` contains the following users:
* User1: A standard member user who is not assigned any administrator roles.
* User2: A member user assigned the Helpdesk Administrator role.
* User4: A B2B guest user whose identity is managed in an external Microsoft Entra ID tenant.

`User3` is a member user assigned the User Administrator role. `User3` is not a member of `Group1`.

All four users have registered their corporate email address and security questions as authentication methods in contoso.com.

Which users can successfully reset their password by using the SSPR portal of contoso.com?

  1. A
    User1 and User2 only
  2. User1 onlyAnswer
  3. C
    User1 and User3 only
  4. D
    User1, User2, and User4 only

Answer

Only User1 can successfully reset their password.
The correct option is the one stating that only User1 can reset their password. User1 is a standard user scoped to the SSPR policy who has registered the one required method (email). Administrators (User2 and User3) bypass group scoping but are restricted by the default administrator policy requiring two gates, which also excludes security questions. B2B guest users (User4) cannot reset their credentials in the host tenant.

Step-by-Step Solution

1
Evaluate SSPR scope and requirements for the standard user (User1).
User1 is a member of Group1 and holds no admin roles. The scoped SSPR policy applies, requiring 1 method. Since User1 has registered their email (which is an enabled method), User1 can successfully reset their password.
Standard users are governed by the tenant's scoped SSPR policy.
2
Evaluate SSPR requirements for the administrator users (User2 and User3).
Both User2 (Helpdesk Administrator) and User3 (User Administrator) are governed by the default Microsoft Entra ID administrator SSPR policy. This policy automatically applies to administrators, requires two gates (authentication methods), and explicitly excludes security questions as a valid gate. Since both users only have email and security questions registered, they only possess one valid gate (email) and cannot reset their passwords.
Administrators require a two-gate reset process and cannot use security questions.
3
Evaluate SSPR requirements for the B2B guest user (User4).
User4 is an external B2B guest user whose source of authority is an external Microsoft Entra ID tenant. They cannot reset their password in the host tenant's SSPR portal and must do so at their home identity provider.
SSPR in a host tenant is not supported for B2B collaboration users whose credentials are managed by an external identity provider.

Key Concept

Microsoft Entra ID enforces a default two-gate SSPR policy for administrator roles that bypasses group scoping, requires two valid methods, and excludes security questions. Additionally, external B2B guest users cannot use the host tenant's SSPR portal if their credentials are managed by an external identity provider.
Rate this question

Topics

Self-Service Password Reset and External Identities

More questions from this topic