Exam AZ-104 topic 6 question 9 discussion

Answer is not correct. It should be - NO: User2 needs 2 authentication methods. Security questions are not enough to reset password - NO: User1 is not part of the SSPR Group1 - NO: to be able to add security questions to the process. you need Global admin role https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr#prerequisites & https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator-permissions

C0rrect Answer: Box 1: No Two methods are required (Mobile phone and Security questions). Box 2: No Self-service password reset is only enabled for Group2, and User1 is not a member of Group2. Box 3: No To be able to add Security questions to the process, you need to be a Global Administrator. User3 is User Administrator, so User3 cannot add security questions to the reset process. User Administrator doesn’t have MFA permissions. Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/quickstart-sspr https://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directory-passwords-faq https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr#prerequisites https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator

User Access Admin role cannot change the security questions of self service reset password: User Access Admin is one RBAC role, it can only grant RBAC role to the user to access the Azure resources. Global Admin is Entra role, it can manage user, group and domain so it can change the security questions of self service password reset.

WRONG.. No No No

No No No

Tested in LAB : No, No, No

NNN https://learn.microsoft.com/en-us/answers/questions/356305/in-azure-could-the-user-administrator-have-permiss

N N N is correct!

Took a bit of digging, but here are my answers: - NO: User2 must provide two authentication methods before they can reset their password - NO: User 1 is not enabled for SSPR - NO: A User must have the role of global Administrator or Authentication Policy Administrator to change SSPR (https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr).

Box 1: No Two methods are required (Mobile / Security questions). Box 2: No Self-service password reset is only enabled for Group2, and User1 is not a member of Group2. Box 3: No User3 is User Administrator, With a two-gate policy, administrators don't have the ability to use security questions. Admin users cannot do the following: - Cannot manage MFA. - Cannot change the credentials or reset MFA for members and owners of a role-assignable group. https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator

NNN is the answer. https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator

Was on the 09/01/2023 exam.

The Number of methods required to reset option determines the minimum number of available authentication methods or gates a user must go through to reset or unlock his password. It can be set to either 1 or 2. Since this option is set to 2, user2 will not be able to reset his password after only one method has been run. User1 is a member of group1. Self-service password reset is enabled only for group2. As a user administrator, user3 cannot add security questions to the reset process. The following Technet articles contain more information about the topic https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks

N - need mobile phone too N - user2 is not in the group1 N - apparently it needs GA

Box 1: No Two methods are required (Mobile phone and Security questions). Box 2: No Self-service password reset is only enabled for Group2, and User1 is not a member of Group2. Box 3: No To be able to add Security questions to the process, you need to be a Global Administrator. User3 is User Administrator, so User3 cannot add security questions to the reset process. User Administrator doesn’t have MFA permissions.

SSP stands for Self Service Password reset.

For sure NO NO NO and as per others comments - read mlantonis