AZ-500 Secure identity and access Practice Question
Your organization uses Microsoft Entra ID. You need to ensure that users can reset their own passwords without contacting IT. Which feature should you enable?
⚠ Common exam trap
Many candidates confuse Multifactor Authentication (MFA) with SSPR, thinking MFA alone allows password resets, when in fact MFA is only a verification step within SSPR and does not provide the self-service reset functionality itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Self-service password reset (SSPR)
Self-service password reset (SSPR) is the correct feature because it allows users to reset their own passwords without IT intervention. SSPR integrates with Microsoft Entra ID and can be configured to require verification methods such as email, phone, or security questions before allowing a password change. This directly meets the requirement of enabling users to reset passwords independently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identity Protection
Why it's wrong here
Identity Protection is an Microsoft Entra ID P2 feature that evaluates sign-in and user risk signals, such as leaked credentials and atypical travel. It can enforce conditional access policies that require multifactor authentication or block risky sessions, but it does not implement a self-service password reset workflow. Even when Identity Protection detects a compromised account and prompts a password change, that change is executed via SSPR if enabled; the detection service itself offers no direct reset mechanism.
- ✓
Self-service password reset (SSPR)
Why this is correct
Self-service password reset (SSPR) is an Microsoft Entra ID (Entra ID) feature that lets users reset or unlock their own passwords without administrator intervention. When enabled, users must first register authentication methods (e.g., authenticator app, phone, or security questions), which are used to verify identity during the reset flow. Because the goal is explicitly to ensure users can reset their own passwords, SSPR is the correct control—it provides the user-facing, self-directed reset capability that the other options lack.
- ✗
Multifactor authentication
Why it's wrong here
Multifactor authentication (MFA) is a security control that requires users to present a second verification factor (like a code from a mobile app) alongside their password. MFA strengthens authentication and helps block unauthorized access, but it does not provide a mechanism for users to create a new password after they have forgotten it. In fact, MFA can serve as a verification step within an SSPR flow, but by itself it cannot satisfy the requirement that users be able to reset their own passwords.
- ✗
Password Protection
Why it's wrong here
Entra ID Password Protection enforces password policies by rejecting weak or compromised passwords through features like the banned password list and smart lockout. It actively blocks users from selecting common or organization-specific weak passwords during a change or reset, but it does not offer any self-service interface or workflow for recovering a forgotten password. Password Protection is a policy enforcement layer that complements SSPR—it narrows what can be chosen, but it does not enable the user to initiate and complete a reset.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.