mediumMultiple Choice
MS-102 Practice Question: A company uses Microsoft Entra Connect with…
A company uses Microsoft Entra Connect with password hash synchronization. They want to allow users to reset their on-premises Active Directory passwords from the cloud Self-Service Password Reset (SSPR) portal. Which additional configuration is required in Microsoft Entra Connect?
⚠ Common exam trap
Candidates often confuse enabling SSPR in Microsoft Entra ID (a tenant-level setting) with the specific Microsoft Entra Connect feature (password writeback) that is required to make SSPR work for synchronized users, leading them to select Option B instead of A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable password writeback
Password writeback is the specific feature in Microsoft Entra Connect that enables password changes performed in the cloud (via SSPR) to be written back to the on-premises Active Directory. Without this feature enabled and configured, the SSPR portal can only reset cloud-only passwords, not synchronized on-premises passwords. Therefore, enabling password writeback is the additional configuration required beyond the existing password hash synchronization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable password writeback
Why this is correct
Password writeback in Microsoft Entra Connect is the component that synchronizes password changes from Microsoft Entra ID back to on-premises Active Directory. With password hash sync, the cloud authentication works, but a cloud-initiated reset only updates the Microsoft Entra ID password unless writeback is enabled. This feature requires Microsoft Entra ID Premium and an on-premises service account with rights to update user passwords, ensuring the next sign-in with on-premises credentials uses the new password.
- ✗
Enable self-service password reset in Microsoft Entra ID
Why it's wrong here
Enabling Microsoft Entra ID self-service password reset configures the end-user reset experience and polices, but for synchronized users it only changes the cloud password unless password writeback is present. SSPR can reset passwords for cloud-only accounts without any on-premises integration, yet when the user's identity originates from on-premises AD, the reset must propagate back via writeback to update the authoritative directory. Therefore, SSPR is a necessary policy layer, but it cannot deliver the required on-premises password update by itself.
- ✗
Configure Federation Services (AD FS)
Why it's wrong here
Federation Services (AD FS) is unnecessary because the deployment already uses password hash synchronization, where Microsoft Entra ID performs authentication against the synchronized hash rather than issuing federated authentication redirects. AD FS would only replace the authentication mechanism and does not inherently provide password writeback; writeback is delivered through the Microsoft Entra Connect synchronization engine, not through federation protocols. Adding AD FS introduces a separate federation infrastructure, extra certificate management, and still requires configuring writeback separately for hybrid password reset.
- ✗
Install Microsoft Entra application proxy
Why it's wrong here
Microsoft Entra application proxy is a reverse proxy that securely publishes legacy on-premises web applications to remote users through the Microsoft Entra ID service. It has no role in password synchronization, password reset, or directory updates, as it merely relays HTTP traffic to internal apps. Installing Application Proxy would not enable password changes to flow back to on-premises AD, so it is completely unrelated to the required hybrid writeback functionality.
Visual reference
Go deeper
Related to this question
Learn chapter
Entra ID Governance Portal
Key term
Microsoft Entra Connect
Microsoft Entra Connect is a tool that synchronizes on-premises Active Directory identities with Microsoft Entra ID (formerly Azure AD) to enable single sign-on and centralized identity management.
Key term
Self-service password reset
Self-service password reset (SSPR) is a Microsoft identity feature that allows users to reset their own passwords without needing help from an IT helpdesk.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.