SC-900 Describe the capabilities of Microsoft Entra Practice Question
An organization wants to allow users to reset their own passwords without help desk intervention. Which Microsoft Entra feature should they enable?
⚠ Common exam trap
Many candidates confuse Conditional Access (which controls access after authentication) with SSPR (which handles the password reset process itself), leading them to select A because they think 'self-service' implies a policy-based control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Self-service password reset
Self-service password reset (SSPR) is the Microsoft Entra feature specifically designed to allow users to reset their own passwords without requiring help desk intervention. It enforces security through authentication methods (e.g., phone, email, security questions) and can be configured to meet organizational policies. This directly addresses the scenario of reducing help desk workload for password resets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Conditional Access policies evaluate specific conditions, such as user location or device state, during an access attempt to enforce controls like multi-factor authentication or device compliance. While it can dictate *when* a user might be allowed to perform an action like a password reset, it does not provide the underlying mechanism for users to actually initiate and complete the password reset process themselves. Its role is policy enforcement, not direct user self-service functionality.
- ✓
Self-service password reset
Why this is correct
Self-service password reset (SSPR) is the dedicated Azure AD feature that empowers users to securely reset their own forgotten or expired passwords without requiring administrator intervention. Users must first register and verify authentication methods, such as a mobile phone or alternate email, which are then used to confirm their identity during the reset flow. This capability directly addresses the organization's need to allow users to manage their own passwords, enhancing both security and user productivity.
- ✗
Privileged Identity Management
Why it's wrong here
Azure AD Privileged Identity Management (PIM) is designed to manage, control, and monitor access to privileged roles within Azure AD and Azure resources. It focuses on providing just-in-time and just-enough access, requiring activation for elevated permissions to reduce the attack surface associated with standing administrative roles. PIM's scope is strictly limited to securing and auditing administrative roles, not enabling standard end-users to reset their personal passwords.
- ✗
Identity Protection
Why it's wrong here
Azure AD Identity Protection is a security tool focused on detecting and remediating identity-based risks, such as compromised credentials, impossible travel, or suspicious IP addresses. It identifies vulnerabilities and automates responses to protect identities from attack, for example, by blocking sign-ins or requiring multi-factor authentication. While crucial for security, it does not offer a user-facing function for resetting passwords; its role is risk detection and response, not user self-service.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Self-service password reset
Self-service password reset (SSPR) is a Microsoft identity feature that allows users to reset their own passwords without needing help from an IT helpdesk.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.