AZ-500 Secure identity and access Practice Question
Which THREE of the following are required to configure Microsoft Entra ID self-service password reset (SSPR)?
⚠ Common exam trap
It's easy for candidates to assume password writeback is always required for SSPR, but it is only necessary when integrating with on-premises Active Directory; for cloud-only users, SSPR works without it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID P1 or P2 license
Option A is correct because Microsoft Entra ID self-service password reset requires a Microsoft Entra ID P1 or P2 license (or Microsoft 365 Business Premium, which includes Entra ID P1 features); the P1 tier is the minimum paid license that unlocks SSPR for cloud-only and hybrid users. Option D is correct because users must register their authentication methods (such as Microsoft Authenticator, email, phone, or security questions) before they can prove their identity and reset their own password. Option E is correct because an administrator must explicitly enable SSPR in the tenant (for example, by selecting All users or a pilot group under Password reset > Properties), since the feature is not active by default. Option B is not required because Premium P2 is not the minimum license — P1 already satisfies the SSPR licensing requirement, and P2 is only needed for features like Identity Protection and Privileged Identity Management. Option C is not required because password writeback is only necessary for hybrid environments where the password must sync back to on-premises Active Directory via Microsoft Entra Connect; for cloud-only users, SSPR works without writeback.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID P1 or P2 license
Why this is correct
Microsoft Entra ID P1 or P2 license includes self-service password reset (SSPR) at either tier, so a P1 subscription is the minimum required for this feature. P1 provides full SSPR functionality for cloud-managed users, while P2 layers on advanced capabilities like Identity Protection and Privileged Identity Management that are not prerequisites for password reset. Therefore, stating P1 or P2 is the accurate licensing requirement, as P2 is not necessary.
- ✗
Microsoft Entra ID Premium P2 license
Why it's wrong here
While Microsoft Entra ID P2 does include SSPR along with additional premium features, it is incorrect to require P2 because P1 already delivers the complete SSPR experience. P2 adds identity governance, risk-based conditional access, and privileged identity tools—none of which are needed for basic user password resets. Thus, P2 is an overqualified answer and not a mandatory prerequisite for configuring SSPR.
- ✗
Password writeback must be enabled
Why it's wrong here
Password writeback is only required for hybrid identity environments where user accounts are synchronized from on-premises Active Directory and password changes need to be written back to that directory. For cloud-only users, SSPR operates entirely within Microsoft Entra ID and has no dependency on on-premises infrastructure, making writeback an optional feature rather than a universal requirement. Enabling writeback without a hybrid deployment would have no effect and is not a valid prerequisite.
- ✓
Users must register for authentication methods
Why this is correct
User registration for authentication methods is a mandatory prerequisite because SSPR must have a way to verify the user's identity before allowing a password reset. Administrators define which methods are permitted (such as phone, alternate email, or security questions), and users must provide at least one registered method in advance. Without this registration, no identity validation is possible, so SSPR cannot function, making registration a fundamental part of setup.
- ✓
SSPR must be enabled in the tenant
Why this is correct
SSPR must be explicitly enabled by an administrator in Microsoft Entra ID, along with selecting the target users or groups and configuring the allowed authentication methods. This setting is not active by default, and until it is turned on, users cannot reset their own passwords even if licenses and registrations exist. This enablement step is the initial configuration action that makes SSPR available, reinforcing it as a hard requirement.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.