mediumMultiple ChoiceObjective-mapped
MS-102 Practice Question: A company uses password hash synchronization with…
A company uses password hash synchronization with Microsoft Entra Connect. The security team wants to enable self-service password reset (SSPR) so that users can reset their own passwords, and the password changes must be written back to the on-premises Active Directory. Which additional configuration is required to achieve password writeback?
⚠ Common exam trap
Many exam-takers confuse configuring the SSPR policy setting (Option D) with the actual installation requirement, assuming the admin center toggle alone enables writeback without realizing the Entra Connect component must be installed first.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install Microsoft Entra Connect with password writeback enabled
Password writeback requires the installation of Microsoft Entra Connect with the password writeback feature explicitly enabled during setup. This allows password changes initiated via SSPR to be written back to on-premises Active Directory. Option C is correct because it directly addresses the necessary infrastructure component.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure SSPR to use federation with on-premises AD FS
Why it's wrong here
Federation changes the authentication protocol to AD FS but does not install or enable the password writeback connector in Microsoft Entra Connect. Password writeback is a separate service that runs on-premises and is independent of whether the tenant uses password hash sync or federation. Configuring SSPR for federation only addresses the sign-in method; it does not provision the required writeback endpoint, so the on-premises directory would still receive no password updates.
- ✗
Enable password hash synchronization in Microsoft Entra Connect
Why it's wrong here
Password hash synchronization is a one-way hash transfer from on-premises Active Directory to Microsoft Entra ID; it never transports passwords in the reverse direction. In this scenario, PHS is already in use, and re-enabling it would not add writeback functionality. Password writeback is a distinct optional feature in the Microsoft Entra Connect configuration that must be selected separately during installation or reboot.
- ✓
Install Microsoft Entra Connect with password writeback enabled
Why this is correct
To allow SSPR password changes to be written back, Microsoft Entra Connect must be installed or reconfigured with the 'Password writeback' optional feature checked. This action installs the writeback service on the sync server, which connects to the on-premises AD and enables the tenant to accept cloud-originated password resets. After enabling this component, the cloud-side SSPR property must also be set to 'Yes' to complete the configuration.
- ✗
Set the SSPR property 'Password writeback' to 'Yes' in the Microsoft Entra admin center
Why it's wrong here
The SSPR directory configuration property 'Enable Password Writeback for users in this app' is only the cloud-side toggle; it merely instructs Microsoft Entra ID to route password changes to the on-premises environment through the Entra Connect agent. If the agent itself was not installed with the password writeback feature, no endpoint exists to receive that request, so the reset operation fails or appears successful only in the cloud. The on-premises writeback component must be present first, making this setting alone insufficient.
Visual reference
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Self-service password reset
Self-service password reset (SSPR) is a Microsoft identity feature that allows users to reset their own passwords without needing help from an IT helpdesk.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.