Exam AZ-104 topic 2 question 106 discussion

The correct answer is D, you can not assign SSPR to individual users it has to be a group. It can be a Security Group or a M365 Group.

Correct. It could be E also, but only if the 365 group was security enabled, and it doesn't mention that in the question.

Yes, Microsoft Entra's Self-Service Password Reset (SSPR) can be enabled for individual users and security groups, but not directly for Microsoft 365 groups. Important Considerations: Security Groups: SSPR can be enabled for security groups, applying the configuration to all members within those groups. Microsoft 365 Groups: SSPR cannot be directly enabled for Microsoft 365 groups. To apply SSPR settings to users within a Microsoft 365 group, you would need to add those users to a security group and then enable SSPR for that security group. Individual Users: While there's no direct method to enable SSPR for individual users without using groups, you can achieve this by creating a security group specifically for those users and enabling SSPR for that group. https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr?utm_source=chatgpt.com

When you're comfortable with the process and the time is right to communicate the requirements with a broader set of users, you can select a group of users to enable for SSPR. Or, you can enable SSPR for everyone in the Microsoft Entra tenant. https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr#enable-self-service-password-reset

Entra ID has 3 options for SSPR, 1- none 2-Group 3- All so we can set SSPR for users and groups

Correct Answer D. You can Enable SSPR for Groups (both Security and M365) OR ALL users, but not individual users.

I checked this https://learn.microsoft.com/en-us/training/modules/allow-users-reset-their-password/3-implement-azure-ad-self-service-password-reset and found that to enable self-service password reset (SSPR) for a single user, you must specify a security group. I tested it in the lab, and it also allows an M365 group to be selected for SSPR. Correct Answer is Security Group or a M365 Group

The key word here is "enable". You can assign SSPR only to individual user, who you then can put in a group. However, in Azure you can ENABLE either to selected users or users grouped in a security group. Therefore, for me the answer is C.

Imo this should be C, as the question states that the subscription only contains the listed user and groups. The article bellow states that we can either enable SSPR for all users (which is only User1 in this case) or for a security group. M365 group is not mentioned. https://learn.microsoft.com/en-us/training/modules/allow-users-reset-their-password/3-implement-azure-ad-self-service-password-reset

You can assign SSPR to individual users and Security Groups, but Microsoft 365 Groups are not supported. Correct answer: C. User1 and Group1 only.

You cannot enable Self-Service Password Reset (SSPR) for an individual user; it must be done for a group. Currently, you can only enable one Microsoft Entra group for SSPR using the Microsoft Entra admin center. References: Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset Self-service password reset (SSPR) can only be enabled for security groups in Microsoft Entra ID. It cannot be enabled for Microsoft 365 groups. The self-service group management features do not apply to mail-enabled security groups or distribution lists. References:

You cannot enable Self-Service Password Reset (SSPR) for an individual user; it must be done for a group. Currently, you can only enable one Microsoft Entra group for SSPR using the Microsoft Entra admin center. References: Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset

To enable **Self-Service Password Reset (SSPR)** in Azure, the following conditions apply: --- ### **Who can SSPR be enabled for?** 1. **Individual Users (e.g., User1)**: - SSPR can be enabled for specific users in Azure AD. 2. **Security Groups (e.g., Group1)**: - SSPR can be enabled for security groups, and all members of the group will inherit the SSPR policy. 3. **Microsoft 365 Groups (e.g., Group2)**: - SSPR **cannot** be enabled for Microsoft 365 groups. Azure AD does not support enabling SSPR for Microsoft 365 groups. --- ### **Analysis of Options**: - **User1**: Eligible for SSPR. - **Group1 (Security group)**: Eligible for SSPR. - **Group2 (Microsoft 365 group)**: **Not eligible** for SSPR. --- ### **Correct Answer**: **C. User1 and Group1 only**.

User1: Individual user accounts can have Self-Service Password Reset (SSPR) enabled directly. Group1: Security groups can be selected to enable SSPR for all their members. Group2: Microsoft 365 groups are not supported for SSPR configuration.

Vous pouvez activer SSPR pour User1 (utilisateur individuel). Vous pouvez également activer SSPR pour un groupe de sécurité comme Group1. Vous ne pouvez pas activer SSPR pour un groupe Microsoft 365 comme Group2.

You cannot directly enable SSPR for individual users, you must always use a group to manage access.

https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr Explanation: SSPR can be set to group or users (all). The group has to be a Security group and the question doesn’t state Group2 as a Security group. The question only mention 1 single user All above give that when selecting users, the identity User1 be included. When selecting a group the identity Group1 is the only option.