MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
A company uses Microsoft Entra ID and has enabled self-service password reset (SSPR). Users are required to register for SSPR. Management wants to ensure that users from the HR department, who handle sensitive data, must use two methods for authentication during SSPR, while other users can use one method. What is the best way to achieve this?
⚠ Common exam trap
Test-takers frequently assume group-based targeting for SSPR extends to authentication method requirements, when in reality group targeting only controls which users are enabled for SSPR, not the number of methods required, which is a tenant-wide setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
This is not possible because SSPR authentication method requirements are tenant-wide
SSPR authentication method requirements in Microsoft Entra ID are configured at the tenant level, not per user or group. This means you cannot specify that one group of users must use two methods while others use one; the number of methods required applies uniformly to all users enabled for SSPR. Therefore, option D is correct because the requirement cannot be differentiated by department or group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a separate SSPR policy for the HR department using PowerShell
Why it's wrong here
SSPR configuration is managed through Microsoft Entra ID authentication methods and password reset settings, which are tenant-wide objects. There is no PowerShell cmdlet that can scope self-service password reset policy to a specific security group or department. Even with Microsoft Graph PowerShell, authentication method policies and SSPR settings apply to all users; PowerShell cannot create a separate policy for a subset.
- ✗
Use Microsoft Entra ID Governance to create an access package that requires two methods
Why it's wrong here
Access packages in Entra ID Governance govern entitlement to resources like groups, apps, or SharePoint sites, not authentication requirements for password reset. They can include policies for who can request and approval workflows, but they do not alter the SSPR authentication method requirements. The number of methods required for SSPR is a tenant-wide setting, not something an access package can enforce.
- ✗
Assign the HR users to a group and configure the SSPR policy for that group in the Entra admin center
Why it's wrong here
SSPR settings such as the number of methods required and which methods are allowed are configured under the 'Authentication methods' and 'Password reset' blades in the Entra admin center, and those configurations apply to the entire tenant. Although groups can be used to target some policies like Conditional Access, SSPR does not support group-based scoping. The admin center only allows a single tenant-wide policy; there is no group selector.
- ✓
This is not possible because SSPR authentication method requirements are tenant-wide
Why this is correct
The requirement for two authentication methods to reset a password is a tenant-wide SSPR setting that cannot be overridden for a subset of users. In Microsoft Entra, the SSPR policy, including the number of methods required and the authentication methods available, is global. To enforce a different number of methods for HR, you would need a separate tenant or an alternative mechanism like Conditional Access MFA, which is not the same as SSPR's method count.
Go deeper
Related to this question
Learn chapter
Data Loss Prevention Policies
Key term
Self-service password reset
Self-service password reset (SSPR) is a Microsoft identity feature that allows users to reset their own passwords without needing help from an IT helpdesk.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.