SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID and wants to enable employees to reset their own passwords without needing to contact the help desk. They want to enforce multifactor authentication when the employee performs the reset. Which Microsoft Entra feature should they enable?
⚠ Common exam trap
Many exam-takers confuse Identity Protection (which detects risky password changes) with SSPR (which enables the actual password reset), leading them to select Option C instead of A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Self-Service Password Reset (SSPR)
Microsoft Entra Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without help desk intervention, and it can be configured to require multifactor authentication (MFA) during the reset process. This aligns directly with the scenario of enabling self-service password changes while enforcing MFA for security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra Self-Service Password Reset (SSPR)
Why this is correct
Microsoft Entra Self-Service Password Reset (SSPR) is a Microsoft Entra ID feature that empowers users to reset their forgotten or locked passwords without requiring administrator assistance. It significantly reduces helpdesk calls by allowing users to verify their identity through pre-registered authentication methods, such as a mobile app notification, text message, or email to an alternate address. This self-service capability enhances user productivity and can be configured to enforce multi-factor authentication during the reset process for heightened security.
- ✗
Microsoft Entra ID Federation
Why it's wrong here
Microsoft Entra ID Federation establishes trust relationships with external identity providers, such as on-premises Active Directory Federation Services (AD FS) or third-party IdPs. This allows users from those external directories to authenticate to Microsoft Entra ID-connected applications using their existing credentials. While crucial for hybrid identity scenarios and single sign-on across organizational boundaries, federation does not directly provide a mechanism for users to independently reset their forgotten passwords within Microsoft Entra ID itself.
- ✗
Microsoft Entra Identity Protection
Why it's wrong here
Microsoft Entra Identity Protection is a security module focused on detecting potential vulnerabilities and suspicious activities related to user identities. It analyzes sign-in behaviors and user accounts for risks like leaked credentials, impossible travel, or unfamiliar sign-in properties, and can automate remediation actions such as blocking access or prompting for multi-factor authentication. While it can trigger a password change if a risk is detected, Identity Protection's primary function is risk detection and response, not providing a user-initiated self-service password reset portal.
- ✗
Microsoft Entra Privileged Identity Management (PIM)
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is a service designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables just-in-time (JIT) and just-enough-access (JEA) for privileged roles, requiring users to activate roles for a limited time and providing auditing capabilities. PIM's focus is on securing and governing elevated administrative access, not on empowering general users to reset their own standard account passwords.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.