AZ-104 Manage Azure Identities and Governance Practice Question
Your organization has an Azure Active Directory (Azure AD) tenant with 500 users. You need to ensure that users can reset their own passwords without IT support, but only if they have registered for multi-factor authentication (MFA). Additionally, you want to prevent users from reusing their last 10 passwords. Which three of the following should you configure? (Choose three.)
⚠ Common exam trap
Candidates often confuse 'Combined registration' with enforcing MFA registration for SSPR, but combined registration only simplifies the user interface, not the policy requirement; the actual enforcement comes from setting the number of methods required to reset and ensuring MFA is one of those methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'Self-service password reset' feature in Azure AD.
To allow users to reset their own passwords without IT support, you must enable the 'Self-service password reset' (SSPR) feature in Azure AD. To prevent password reuse, you set the 'Number of passwords remembered' policy to 10 in the Password reset blade, which enforces a password history of 10 unique passwords. Finally, to ensure that only users registered for MFA can reset their passwords, you configure the 'Number of methods required to reset' to 2 and require MFA registration, which forces users to provide two authentication methods (including MFA) before resetting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable the 'Self-service password reset' feature in Azure AD.
Why this is correct
Enabling the Self-Service Password Reset feature in Azure AD turns on the required policy so licensed users can regain access to their accounts without administrator intervention. You must select either 'Selected' or 'All' users, and unlicensed or unconfigured users will not receive the reset capability. This is the foundational action; without this switch, the other password reset settings have no effect.
- ✗
Configure 'Password protection' with a custom banned password list.
Why it's wrong here
A custom banned password list is a Password Protection feature that blocks weak or compromised passphrases during password set and reset operations. It does not create any user-facing password reset workflow or allow users to independently initiate a reset. It is compatible with SSPR, but it is an additive security filter, not the mechanism that permits self-service password reset.
- ✓
Set the 'Number of passwords remembered' policy to 10 in the 'Password reset' blade.
Why this is correct
Setting the 'Number of passwords remembered' to 10 is a password-history policy inside the Azure AD Password Reset blade. It prevents users from reusing any of their previous ten passwords when completing a reset, which is a valid compliance hardening control. While it does not enable SSPR, it is a proper configuration detail within an SSPR-enabled tenant.
- ✓
Configure the 'Number of methods required to reset' to 2 and require MFA registration.
Why this is correct
Requiring two methods to reset plus mandatory MFA registration raises the assurance level of password resets. With 'Number of methods required to reset' set to 2, users must provide two registered authentication methods, such as a phone and an authenticator app, before Azure AD allows a new password. Combined with forcing MFA registration, this ensures that users have the necessary security info pre-registered, so it is a recommended configuration alongside SSPR.
- ✗
Enable 'Combined registration' for security info to simplify MFA and SSPR registration.
Why it's wrong here
Combined registration is a user-facing onboarding experience that captures security information for both Microsoft Entra MFA and SSPR in a single flow. It improves the likelihood that users register accurate methods, but it does not by itself enable the password reset feature. If SSPR is disabled, users still cannot reset their passwords regardless of how complete their security info is, so this option addresses registration convenience, not the reset capability itself.
- ✗
Assign the 'Global Administrator' role to all users to allow password reset.
Why it's wrong here
Making every user a Global Administrator is a severe privilege escalation that violates least privilege and expands the attack surface, since the Global Administrator role has tenant-wide control. While Global Administrators can reset passwords manually, that ability is an administrative function, not self-service reset for all users. Users should only need the SSPR permission granted by the SSPR feature, not a directory-wide administrative role, making this option wrong.
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.