mediumMultiple ChoiceObjective-mapped
MS-102 Practice Question: Password writeback is an Azure AD Connect feature.
A company uses Azure AD Connect with password hash synchronization. They want to allow users to reset their on-premises Active Directory passwords from the cloud Self-Service Password Reset (SSPR) portal. Which additional configuration is required in Azure AD Connect?
⚠ Common exam trap
Candidates often confuse enabling SSPR in Azure AD (a tenant-level setting) with the specific Azure AD Connect feature (password writeback) that is required to make SSPR work for synchronized users, leading them to select Option B instead of A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable password writeback
Password writeback is the specific feature in Azure AD Connect that enables password changes performed in the cloud (via SSPR) to be written back to the on-premises Active Directory. Without this feature enabled and configured, the SSPR portal can only reset cloud-only passwords, not synchronized on-premises passwords. Therefore, enabling password writeback is the additional configuration required beyond the existing password hash synchronization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable password writeback
Why this is correct
Password writeback in Azure AD Connect is the component that synchronizes password changes from Azure AD back to on-premises Active Directory. With password hash sync, the cloud authentication works, but a cloud-initiated reset only updates the Azure AD password unless writeback is enabled. This feature requires Azure AD Premium and an on-premises service account with rights to update user passwords, ensuring the next sign-in with on-premises credentials uses the new password.
- ✗
Enable self-service password reset in Azure AD
Why it's wrong here
Enabling Azure AD self-service password reset configures the end-user reset experience and polices, but for synchronized users it only changes the cloud password unless password writeback is present. SSPR can reset passwords for cloud-only accounts without any on-premises integration, yet when the user's identity originates from on-premises AD, the reset must propagate back via writeback to update the authoritative directory. Therefore, SSPR is a necessary policy layer, but it cannot deliver the required on-premises password update by itself.
- ✗
Configure Federation Services (AD FS)
Why it's wrong here
Federation Services (AD FS) is unnecessary because the deployment already uses password hash synchronization, where Azure AD performs authentication against the synchronized hash rather than issuing federated authentication redirects. AD FS would only replace the authentication mechanism and does not inherently provide password writeback; writeback is delivered through the Azure AD Connect synchronization engine, not through federation protocols. Adding AD FS introduces a separate federation infrastructure, extra certificate management, and still requires configuring writeback separately for hybrid password reset.
- ✗
Install Azure AD Application Proxy
Why it's wrong here
Azure AD Application Proxy is a reverse proxy that securely publishes legacy on-premises web applications to remote users through the Azure AD service. It has no role in password synchronization, password reset, or directory updates, as it merely relays HTTP traffic to internal apps. Installing Application Proxy would not enable password changes to flow back to on-premises AD, so it is completely unrelated to the required hybrid writeback functionality.
Visual reference
Go deeper
Related to this question
Learn chapter
Hybrid Identity with Entra Connect
Key term
Azure AD Connect
Azure AD Connect is a Microsoft tool that synchronizes on-premises Active Directory identities with Azure Active Directory for unified cloud and on-premises access.
Key term
Self-service password reset
Self-service password reset (SSPR) is a Microsoft identity feature that allows users to reset their own passwords without needing help from an IT helpdesk.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.