MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
Your organization has a hybrid identity deployment using Microsoft Entra Connect Sync. You need to ensure that password writeback is enabled so that users can reset their own passwords from the cloud. Which prerequisite must be met?
⚠ Common exam trap
Candidates often assume password hash synchronization must be enabled for any password-related feature, but password writeback is a separate SSPR function that does not depend on hash sync and can be used with other authentication methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Self-Service Password Reset (SSPR) must be enabled in Microsoft Entra ID
Password writeback requires that Self-Service Password Reset (SSPR) is enabled in Microsoft Entra ID because writeback is a feature of SSPR that allows password changes initiated in the cloud to be written back to the on-premises Active Directory. Without SSPR enabled, the cloud tenant has no mechanism to trigger the writeback operation, even if the Entra Connect Sync configuration is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Self-Service Password Reset (SSPR) must be enabled in Microsoft Entra ID
Why this is correct
Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID is the controlling service that invokes password writeback. When a user resets a forgotten password through the SSPR portal, the cloud tenant calls back to the on-premises directory via the Microsoft Entra Connect sync engine, and only if SSPR is toggled on with the writeback option does the tenant pass the new password value back to the local Active Directory domain. Thus, without SSPR enabled and configured, there is no cloud-side operation to trigger the writeback service, regardless of how the on-premises sync is set up.
- ✗
Password hash synchronization must be enabled
Why it's wrong here
Password hash synchronization is not a prerequisite for password writeback because the two features operate on different data paths. Writeback sends a new password (or its hash) from the cloud down to the on-premises Active Directory through the service connection point, while password hash synchronization is an upward flow of already-created hashes for authentication. Even organizations using federation or pass-through authentication can enable writeback as long as SSPR and the sync service are properly configured, proving PHS is not required.
- ✗
Azure MFA must be enabled for all users
Why it's wrong here
Azure Multi-Factor Authentication (MFA) is an authentication step that can be used to verify a user's identity during a password reset, but it is not mandatory to enable writeback. SSPR can be configured with or without requiring MFA for all users, and the writeback operation itself is independent of the MFA challenge. An administrator should note that MFA is a security enhancement, not a linkage to the internal AD writeback pipeline, so enforcing MFA for every user does not unlock or disable writeback functionality in any direct way.
- ✗
Microsoft Entra ID P2 licenses must be assigned
Why it's wrong here
License-wise, password writeback is available with Microsoft Entra ID P1, Microsoft 365 E3, and other P1-equivalent plans; there is no P2 licensing requirement. P2 adds premium identity protection features such as risk-based conditional access and identity governance, but those capabilities are not invoked by the SSPR password writeback process. An administrator can successfully enable writeback with only P1 licenses assigned, making P2 an optional addition that is not a prerequisite for the feature.
Visual reference
Go deeper
Related to this question
Learn chapter
Microsoft Defender for Cloud Apps Administration
Key term
Hybrid identity
Hybrid identity is an approach that synchronizes and manages user identities across both on-premises directories and cloud-based services, allowing seamless access to resources in both environments.
Key term
Self-service password reset
Self-service password reset (SSPR) is a Microsoft identity feature that allows users to reset their own passwords without needing help from an IT helpdesk.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.