MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
Your organization uses Microsoft Entra ID. You need to enable users to reset their own passwords without administrator intervention. Which TWO components must be configured?
⚠ Common exam trap
A common mix-up: candidates confuse optional security features like Identity Protection or Conditional Access as prerequisites for SSPR, when in fact only SSPR enablement and authentication method registration are strictly required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra self-service password reset (SSPR)
Microsoft Entra self-service password reset (SSPR) is the core feature that allows users to reset their own passwords without administrator intervention. It must be enabled and configured at the tenant level, and it relies on users having registered authentication methods to verify their identity during the reset process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra self-service password reset (SSPR)
Why this is correct
Microsoft Entra self-service password reset (SSPR) is the license-enabled feature that must be explicitly toggled on and configured for users to reset or change their own passwords without administrator intervention. The 'Enable self-service password reset' setting must be set to 'Selected' or 'All' (or via group assignment), and the reset process is governed by policies and authentication requirements. Its purpose is exactly the requested capability: allow users to self-reset when locked out or expired.
- ✗
Microsoft Entra Identity Protection
Why it's wrong here
Microsoft Entra Identity Protection is a risk-detection service that flags suspicious activities such as leaked credentials, anonymous IP addresses, or impossible travel, but it does not implement the actual password reset flow. While Identity Protection can trigger a risk-based policy that forces a password change when a user is deemed risky, the underlying reset mechanism is still performed through SSPR. Identity Protection is not a prerequisite for SSPR and cannot, by itself, enable self-service password reset.
- ✗
Conditional Access policies
Why it's wrong here
Conditional Access policies are access control rules that evaluate signals like user, location, device compliance, or risk to grant or block access, and they can enforce MFA or require a password reset in certain risk scenarios. They can complement SSPR by requiring additional verification during the reset process (e.g., via its own registration or authentication strengths), but they are not necessary on their own to make self-service password reset functional. You can enable SSPR and have users reset passwords without creating any Conditional Access policy.
- ✗
Microsoft Entra Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) focuses on time-bound and approval-based activation of privileged role assignments, such as Global Administrator, and provides access reviews and alerts. PIM does not expose any controls for end-user plaintext password reset; it manages who can perform a password reset for others (if granted admin role) but the actual reset mechanism is either SSPR or an admin action. Enabling PIM does not turn on self-service password reset and is a distinct capability for elevated directory roles.
- ✓
Authentication methods registration
Why this is correct
Before users can use SSPR effectively, each user must register at least one authentication method (phone, email, security questions, or the Microsoft Authenticator app) so that they can prove their identity during the reset process. Authentication methods registration can be enforced through a combined registration experience or a registration policy, but it is a separate configuration step from enabling SSPR. Without registered methods, SSPR cannot verify the user, so it is a correct and necessary part of making self-service password reset work end to end.
Go deeper
Related to this question
Learn chapter
Entra Connect Cloud Sync
Key term
Self-service password reset
Self-service password reset (SSPR) is a Microsoft identity feature that allows users to reset their own passwords without needing help from an IT helpdesk.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.