Hotspot Question You have an Azure subscription that is linked to a Microsoft Entra tenant named contoso.com. The tenant contains the users shown in the following table. You enable self-service…

This question tests understanding of Azure AD/Microsoft Entra Self-Service Password Reset (SSPR) configuration, specifically how authentication method requirements and user roles (like Global Administrators) affect the SSPR experience.

Submitted by eva_at· Mar 4, 2026Manage identities and governance

Question

Hotspot Question You have an Azure subscription that is linked to a Microsoft Entra tenant named contoso.com. The tenant contains the users shown in the following table. You enable self-service password reset (SSPR) for all users and configure SSPR to have the following authentication methods: - Number of methods required to reset: 2 - Methods available to users: Mobile phone, Security questions - Number of questions required to register: 3 - Number of questions required to reset: 3 You select the following security questions: - What is your favorite food? - In what city was your first job? - What was the name of your first pet? For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibit

Answer Area

SecAdmin1 must answer the following question during the self-service password reset: In what city was your first job?
BillAdmin1 must answer the following question during the self-service password reset: What is your favorite food?
User must answer the following question during the self-service password reset: What was the name of your first pet?

Explanation

Approach. The key concepts to understand: (1) Global Administrators are ALWAYS required to use TWO authentication methods for SSPR regardless of tenant-wide settings - Microsoft enforces a stricter policy for admins, and security questions are NOT available as an authentication method for Global Administrators. (2) When SSPR is configured to require 2 methods and only 'Mobile phone' and 'Security questions' are available, regular users must register both methods. (3) Security questions require users to register answers to at least the number specified (3 in this case), and they must answer the required number correctly to reset. For a Global Admin trying to reset their password using security questions - they CANNOT, because Microsoft's policy explicitly prohibits Global Administrators from using security questions for SSPR. They must use other methods like mobile app notification, mobile app code, email, or mobile phone (SMS/call). Regular users (non-admins) CAN use security questions as configured. If a user has only registered security questions and no mobile phone, they may not be able to complete reset if 2 methods are required and they only have 1 available. Always check: admin vs non-admin role, number of registered methods vs required methods, and whether the specific method is allowed for that user type.

Concept tested. Azure AD / Microsoft Entra Self-Service Password Reset (SSPR) configuration rules, including the special restrictions that apply to Global Administrators (who cannot use security questions and are always required to use 2 authentication methods), and how the number of required methods interacts with available registered methods for regular users.

Reference. Microsoft Learn: How it works - Azure AD self-service password reset | https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks - specifically the section on Administrator reset policy differences, which states that Global Administrators must always use two authentication methods and security questions are never available to them.

Topics

#Microsoft Entra SSPR#Entra authentication methods#Entra security questions

Community Discussion

No community discussion yet for this question.

Full AZ-104 Practice