MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
You need to prevent users from registering security information for Microsoft Entra self-service password reset (SSPR) if they are not in a specific group. What should you configure?
⚠ Common exam trap
MS-102 often tests the confusion between SSPR scope settings and Conditional Access policies, leading candidates to choose Conditional Access for restricting SSPR registration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSPR scope setting to require group membership
The SSPR scope setting in Microsoft Entra ID allows you to restrict self-service password reset registration and usage to a specific group of users. By configuring the scope to 'Selected' and choosing the group, only members of that group can register security information for SSPR. This directly prevents users outside the group from registering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Identity Protection user risk policy
Why it's wrong here
Identity Protection user risk policies act on detected risk levels to require password change or block access; they do not gate who may register SSPR security information. They are tempting because they govern authentication behaviour, but group-based registration scoping belongs to the SSPR Selected group setting.
- ✗
Combined registration for SSPR and Microsoft Entra multifactor authentication
Why it's wrong here
Combined registration controls whether users enrol for SSPR and Microsoft Entra multifactor authentication together; it does not scope registration by group membership. It is tempting because it governs the registration experience, but group-based scoping requires targeting SSPR to a selected group instead.
- ✓
SSPR scope setting to require group membership
Why this is correct
SSPR scope lets you target registration and reset to a single Microsoft Entra group, so users outside that group cannot register security information. This directly satisfies the requirement to restrict registration by group membership rather than disabling SSPR tenant-wide.
- ✗
Conditional Access policy to block registration for non-group members
Why it's wrong here
Conditional Access can block access to the combined registration user interface, but it does not scope SSPR registration to a group; users outside the group would still be enabled for SSPR. It is tempting because it targets registration, yet the SSPR Selected group setting is what restricts enrolment.
Go deeper
Related to this question
Learn chapter
Information Barriers and DLP
Key term
Self-service password reset
Self-service password reset (SSPR) is a Microsoft identity feature that allows users to reset their own passwords without needing help from an IT helpdesk.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.