AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID to manage identities for employees and partners. They need to allow partners to self-service reset their passwords using a mobile app notification. Which feature should you enable?
⚠ Common exam trap
Candidates often confuse Identity Protection (which deals with risk and conditional access) with SSPR, because both involve authentication methods, but Identity Protection does not enable password reset functionality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Self-Service Password Reset (SSPR)
Microsoft Entra ID Self-Service Password Reset (SSPR) is the correct feature because it allows users, including partners configured as external users in the tenant, to reset their own passwords without administrator intervention. SSPR supports multiple authentication methods, including mobile app notification via the Microsoft Authenticator app, which satisfies the requirement for a mobile app notification-based reset. This feature is specifically designed for password reset scenarios and can be scoped to include guest users when properly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Self-Service Password Reset (SSPR)
Why this is correct
Microsoft Entra ID Self-Service Password Reset (SSPR) is the correct choice because it directly addresses the requirement for users to reset their own passwords without IT intervention. SSPR works by having users pre-register authentication methods—such as the Microsoft Authenticator mobile app notification, a phone number, or security questions—and then using one of those methods to verify their identity during the reset flow. This feature is tightly integrated with Entra ID and can be configured with Conditional Access policies to enforce appropriate security controls, making it the right identity-based solution for password self-service.
- ✗
Microsoft Entra ID Identity Protection
Why it's wrong here
Microsoft Entra ID Identity Protection is not a password reset mechanism; its core purpose is to detect and respond to identity-based risks such as compromised accounts, impossible travel, or leaked credentials. While Identity Protection can automatically trigger actions like requiring multi-factor authentication or blocking access based on risk levels, it does not provide users a portal or workflow to reset their own passwords. Its role is protective and diagnostic, not user-initiated credential recovery, so it fails to meet the stated requirement for self-service password reset.
- ✗
Microsoft Intune
Why it's wrong here
Microsoft Intune is a cloud-based unified endpoint management service focused on managing devices and applications, not on identity credential operations like password reset. Intune enforces compliance policies, deploys software, and controls device enrollment for Windows, iOS, and Android, but it does not interact with Entra ID's authentication methods to allow a user to reset their directory password. Since the question pertains to an identity-level capability for password self-service, Intune is an incorrect and non-viable choice.
- ✗
Microsoft Entra ID Privileged Identity Management
Why it's wrong here
Microsoft Entra ID Privileged Identity Management (PIM) is designed to manage, control, and monitor access to privileged administrative roles within Entra ID and Azure resources, providing just-in-time activation and approval workflows. PIM does not include a self-service password reset function; instead, it overshadows role assignments and elevation, which is a separate concern from a user resetting their own forgotten password. Therefore, PIM is irrelevant to the scenario described and cannot fulfill the requirement for SSPR.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 795-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.