Configure Self-Service Password Reset with Two Verification Methods and Password History
Your company, Northwind Traders, uses Microsoft Entra ID P1. You need to allow employees to reset their own passwords without help desk intervention. The company policy requires that password resets be secured with two verification methods. Additionally, users must not be able to reuse the last 10 passwords. The solution must minimize administrative effort. What should you configure?
Quick Answer
The answer is to enable Microsoft Entra self-service password reset (SSPR) and configure the number of methods required to reset to 2, while setting the password history to enforce the last 10 passwords. This is correct because SSPR is the native Microsoft Entra feature designed specifically for password reset without help desk intervention, and its settings allow you to mandate two verification methods—such as a mobile app and an email—as well as enforce a password history policy that prevents reuse of previous passwords. On the MS-102 exam, this scenario tests your ability to distinguish SSPR from other security features like password protection, which only blocks weak passwords, or Privileged Identity Management, which governs admin roles. A common trap is confusing password protection with SSPR or thinking Conditional Access can enforce password history. Remember the mnemonic “SSPR = Self-Service Password Reset” and that history and method count are configured directly inside the SSPR blade, not in separate policies.
⚠ Common exam trap
It's easy for candidates to confuse SSPR with conditional access policies or PIM, as candidates often think MFA enforcement or privileged role management can substitute for the dedicated self-service password reset feature, but only SSPR provides the combined verification method count and password history controls required by the scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Microsoft Entra self-service password reset (SSPR) and configure the number of methods required to reset to 2, and set password history to enforce last 10 passwords
Microsoft Entra self-service password reset (SSPR) allows users to reset their own passwords without help desk intervention. By configuring the number of methods required to reset to 2, you meet the two-verification-method policy requirement. Setting the password history to enforce the last 10 passwords prevents reuse, and since SSPR is a cloud-native feature, it minimizes administrative effort by avoiding on-premises dependencies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Microsoft Entra self-service password reset (SSPR) and configure the number of methods required to reset to 2, and set password history to enforce last 10 passwords
Why this is correct
SSPR provides self-service reset with configurable verification and history.
- ✗
Enable Privileged Identity Management (PIM) for all users
Why it's wrong here
PIM is for role management, not password reset.
- ✗
Enable Microsoft Entra password protection and configure password history in the on-premises policy
Why it's wrong here
Password protection does not enable self-service reset.
- ✗
Configure a conditional access policy to require MFA during password change
Why it's wrong here
Conditional access does not provide self-service reset.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are required to configure Microsoft Entra ID self-service password reset (SSPR) for cloud-only users? (Choose two.)
medium- A.Microsoft Entra ID P1 or P2 license.
- B.Azure AD Connect synchronization.
- ✓ C.Users must be assigned a license.
- ✓ D.A paid Microsoft 365 license.
- E.Users must register for MFA.
Why C: Each user must be assigned a Microsoft Entra ID license (such as P1 or P2) to be eligible for SSPR. Without a license assignment, the user cannot use the SSPR feature, even if the tenant has the required licenses available. Option D is correct because a paid Microsoft 365 license (e.g., Microsoft 365 Business Premium, E3, or E5) includes the necessary Microsoft Entra ID P1 or P2 functionality, which is required for SSPR. Cloud-only users do not require Azure AD Connect or MFA registration for basic SSPR, though MFA is recommended for stronger security.
Variation 2. You need to configure self-service password reset (SSPR) for users in Microsoft Entra ID. Which license is required?
easy- A.Microsoft 365 F3
- B.Microsoft 365 E3
- ✓ C.Microsoft Entra ID P1
- D.Microsoft Entra ID Free
Why C: Self-service password reset (SSPR) requires a Microsoft Entra ID P1 or P2 license. Both Microsoft 365 F3 and Microsoft 365 E3 include Microsoft Entra ID P1 licenses, which support SSPR. However, the question directly asks which license is required for SSPR, and the correct answer is the standalone Microsoft Entra ID P1 license. While F3 and E3 include this license, they are suite licenses and not the specific license component being asked for.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.