AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Your organization is moving to a cloud-only identity model using Microsoft Entra ID. You need to ensure that users can reset their own passwords without help desk intervention. The solution must support multi-factor authentication and notify administrators of password resets. What should you implement?
⚠ Common exam trap
Many candidates confuse password writeback (a prerequisite for hybrid environments) with the actual self-service reset feature, or they mistake Conditional Access policies (which enforce MFA during sign-in) for the self-service reset process itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Self-Service Password Reset (SSPR)
Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords without help desk intervention. It supports multi-factor authentication (MFA) as a verification step before resetting, and can be configured to send notifications to administrators when a password reset occurs. This directly meets all stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Connect Password Writeback
Why it's wrong here
Microsoft Entra Connect Password Writeback is a hybrid identity synchronization feature that propagates password changes made in the cloud back to on-premises Active Directory. It does not provide a user-facing self-service reset portal, nor does it handle identity verification, multi-factor authentication checks, or admin notification on its own. In a cloud-only identity model there is no on-premises directory to write back to, making this option irrelevant for the stated requirement.
- ✗
Conditional Access policies for password change
Why it's wrong here
Conditional Access policies are an access control engine that evaluates sign-in signals such as risk, location, and device state to allow, block, or require MFA during authentication. They cannot initiate a password reset flow on behalf of a user, nor do they expose a self-service interface for users to manage their own credentials. Conditional Access merely enforces conditions at sign-in time; it is not a password-reset mechanism.
- ✓
Microsoft Entra Self-Service Password Reset (SSPR)
Why this is correct
Microsoft Entra Self-Service Password Reset (SSPR) lets users reset or unlock their own passwords through the Microsoft Entra portal using pre-registered authentication methods, satisfying the self-service requirement. It supports multi-factor authentication by requiring verification via methods such as mobile app or SMS before allowing a reset, and administrators can configure email notifications whenever a reset occurs. SSPR works natively in a cloud-only identity model and aligns with all constraints in the scenario.
- ✗
Microsoft Entra ID Protection
Why it's wrong here
Microsoft Entra ID Protection is a risk-engine that detects suspicious user and sign-in behavior and automatically applies risk-based policies, such as blocking access or forcing a password change when high risk is detected. It is not a user-initiated self-service password reset tool; users cannot actively start a reset for voluntary reasons, and it does not provide the SSPR portal's registration and verification workflow. Rather than being a replacement for SSPR, it is an automated risk response control that may act alongside it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.