Courseiva
← MS-102
Full test
easyMultiple Choice

MS-102 Practice Question: Reduce help desk calls by allowing users to reset…

A company wants to reduce help desk calls by allowing users to reset their own passwords securely. Users should be able to reset their passwords using a mobile phone number or email as verification. Which Microsoft Entra ID feature should be enabled?

⚠ Common exam trap

Watch out — candidates often confuse Conditional Access (which controls access after authentication) with SSPR (which handles the authentication recovery process), leading them to select Conditional Access when the question explicitly asks about password reset functionality.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Self-Service Password Reset (SSPR)

Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature specifically designed to allow users to reset their own passwords without help desk intervention. It supports verification methods such as mobile phone number (via SMS or phone call) and email, meeting the company's requirement for secure, user-driven password resets.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Conditional Access

    Why it's wrong here

    Conditional Access is an access-control engine that evaluates real-time sign-in signals such as IP location, device compliance, and user risk to block or allow sessions; it does not supply an end-user portal for initiating a password reset. Even in risk-based policies that force a password change, the change is executed via SSPR, not by Conditional Access itself.

  • ✓

    Self-Service Password Reset (SSPR)

    Why this is correct

    Self-Service Password Reset (SSPR) is a Microsoft Entra ID feature that enables users to reset or unlock their password from a web portal after verifying the authentication methods they registered, such as Microsoft Authenticator, phone numbers, or security questions. It directly addresses password reset support tickets by removing administrator involvement, making it the correct answer for reducing help desk calls.

  • ✗

    Password Protection

    Why it's wrong here

    Microsoft Entra Password Protection examines the new password during a reset or change and rejects known weak passwords, common compromised entries, or custom banned lists based on user-specific substrings. It is a security validation filter, not a reset workflow, so while it improves password security, it cannot issue a reset on its own.

  • ✗

    Identity Protection

    Why it's wrong here

    Identity Protection is a risk-detection and response service that flags suspicious sign-in behavior, such as impossible travel or leaked credentials, and can trigger automated policies requiring MFA or blocking access, or force a password change when user risk is high. However, the forced change is carried out by SSPR; Identity Protection does not expose a self-service reset interface and therefore cannot reduce password reset calls by itself.

About these practice questions

This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on MS-102

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company uses Azure AD Connect with password hash synchronization. They want to allow users to reset their on-premises Active Directory passwords from the cloud Self-Service Password Reset (SSPR) portal. Which additional configuration is required in Azure AD Connect?

medium
  • ✓ A.Enable password writeback
  • B.Enable self-service password reset in Azure AD
  • C.Configure Federation Services (AD FS)
  • D.Install Azure AD Application Proxy

Why A: Password writeback is the specific feature in Azure AD Connect that enables password changes performed in the cloud (via SSPR) to be written back to the on-premises Active Directory. Without this feature enabled and configured, the SSPR portal can only reset cloud-only passwords, not synchronized on-premises passwords. Therefore, enabling password writeback is the additional configuration required beyond the existing password hash synchronization.

Variation 2. A company uses hybrid identity with Azure AD Connect and password hash synchronization. They want to enable Self-Service Password Reset (SSPR) with password writeback so that users can reset their on-premises Active Directory passwords. Which Azure AD license is required?

easy
  • A.Azure AD Free
  • ✓ B.Azure AD Premium P1
  • C.Azure AD Premium P2
  • D.Microsoft 365 E3

Why B: Azure AD Premium P1 is required for Self-Service Password Reset (SSPR) with password writeback. Password writeback is a premium feature that enables password changes in Azure AD to be written back to on-premises Active Directory via Azure AD Connect. Azure AD Free does not include SSPR with writeback, and Azure AD Premium P2 includes additional features like Identity Protection but is not necessary for this scenario.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.