AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Your company has a Microsoft Entra ID tenant with 50,000 users. You need to design a solution to ensure that users can reset their own passwords without help desk intervention, while preventing password reuse for the last 10 passwords. Which feature should you enable?
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Entra ID Protection (which handles risk-based policies) with SSPR, or they mistakenly think PIM is involved because it deals with passwords, but PIM is strictly for privileged role management, not end-user password resets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Self-Service Password Reset (SSPR)
Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without help desk intervention. Additionally, SSPR can be configured with password protection policies that enforce password history, preventing reuse of the last 10 passwords. This directly meets both requirements stated in the question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Protection
Why it's wrong here
Microsoft Entra ID Protection is a risk-based engine that evaluates signals like leaked credentials, impossible travel, and suspicious sign-in patterns, then applies conditional access policies such as requiring MFA or blocking access. Although it can flag an account as at-risk and recommend a password reset as a remediation action, it does not own the password reset workflow or enforce password reuse or complexity policies. Thus, it cannot implement the stated requirement because risk remediation is separate from the self-service password policy engine.
- ✗
Microsoft Entra Connect
Why it's wrong here
Microsoft Entra Connect is a synchronization tool that copies on-premises Active Directory objects to Microsoft Entra ID and, optionally, synchronizes password hashes to enable authentication in the cloud. It has no user-facing password reset portal and does not apply password reuse restrictions; those settings are tenant-level features configured in the password reset and password protection areas. Even when password hash synchronization or password writeback is enabled, Entra Connect only transports or writes back credentials, not enforce the self-service password reset policy.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management (PIM) is a role-based access governance service for just-in-time assignment, approval, and monitoring of privileged roles like Global Administrator. It does not offer a mechanism for users to reset their own passwords, nor does it control password reuse rules; its sole focus is who can activate admin roles and for how long. While an admin could use PIM to request role elevation to reset someone's password manually, that is an operational action delegated to password reset tools, not a policy enforced by PIM.
- ✓
Self-Service Password Reset (SSPR)
Why this is correct
Self-Service Password Reset (SSPR) is the correct Entra ID capability that lets end users reset or change their own passwords after verifying authentication methods such as phone, email, or security questions. Administrators can configure SSPR registration requirements, and by combining SSPR with Entra ID Password Protection, the tenant can enforce password reuse restrictions—for example, specifying that a new password cannot match a remembered set of prior passwords. This directly satisfies the company's need for users to reset their own passwords while enforcing anti-reuse policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.