AZ-104 Question 16
Single answerYou are an Azure administrator for a company planning to introduce self-service password reset (SSPR) to a pilot group of 50 employees. The company requires that at least two authentication methods be provided by each user during the password reset process. You have created an Azure AD security group named 'SSPR_Pilot' containing these 50 employees. Which configuration in the Self-service password reset blade meets these requirements?
- A
Set the scope to All and require only 1 authentication method
- B
Set the scope to Selected, assign the SSPR_Pilot group, and require 2 authentication methods
- C
Set the scope to None and require 2 authentication methods
- D
Set the scope to Selected, assign the SSPR_Pilot group, and require only 1 authentication method
Show answer and explanation
Correct answer: B
Explanation
By setting the SSPR scope to Selected and choosing the SSPR_Pilot group, only those 50 employees are enabled for the feature. Requiring 2 authentication methods fulfills the organization's security policy that users provide multiple factors before resetting their passwords.
- A. Incorrect.
If you set the scope to All, everyone in the tenant can use SSPR, and only requiring 1 authentication method does not satisfy the requirement for 2 methods.
- B. Correct.
Setting the scope to Selected and specifying the pilot group ensures only the pilot group can use SSPR. Requiring 2 methods meets the company’s security policy.
- C. Incorrect.
Setting the scope to None completely disables SSPR, so no one can reset passwords through SSPR, making it not viable for testing or production use.
- D. Incorrect.
Although specifying a pilot group is correct, requiring only 1 authentication method does not meet the requirement for 2 methods.