Exam MS-102 topic 1 question 148 discussion

Box 1: 1,2 and 4 - Admins are always enabled for self-service password reset Box 2: 2 - Admins are required to use two authentication methods to reset their password.

Users who can use SSPR: User1, User2, and User4. Users who must answer security questions to reset their password (under the Group1 policy): User2 only. User1 and User4, as administrators, will follow the default two-gate policy, which does not include security questions.

Answers are correct , SSPR its just for Group 1

Box 1 = user1, user2, user4 Box 2 = user2

Hi Box 2 should only be user 2. As Administrator Roles cannot use security questions as part of SSPR. As explained in this link. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy.

Agree with vincent, use entra / intune every day and 100% correct.

Box 1 - user1 en user 2 only - because member of group 1 Box 2 - User 2 only, User 1 is a admin and needs to use authenticator app or e-mail as well.

Checking it again, in the second response it should be User1 user2 and user4 Since user 1 and user 4 are administrators and user 2 is a member of the group assigned for SSPR. By default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced. This policy may be different from the one you have defined for your users, and this policy can't be changed. You should always test password reset functionality as a user without any Azure administrator roles assigned. With a two-gate policy, administrators don't have the ability to use security questions. The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number. https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-password-policy-differences

I think user 1 and 2 for both. If you select a group, only enable SSPR for this group and nested. The rest of users don´t have access to SSPR