Enable SSPR for Entra Identities

Manage Microsoft Entra users and groups

Answer Correct answer: D — You can enable SSPR for Group1 and Group2 because SSPR scope requires Security or Microsoft 365 groups, not individual users.

You have an Azure subscription that contains the Microsoft Entra identities shown in the following table. You need to enable self-service password reset (SSPR). For which identities can you enable SSPR in the Azure portal? -

User1 only
Group1 only
User1 and Group1 only
Group1 and Group2 only Correct Answer
User1, Group1, and Group2

Community Votes

58%

42%

58% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

SSPR scope configuration requires assigning groups (Security or Microsoft 365), not individual user accounts, which is a common trap for those assuming direct user assignment.

Self-service password reset (SSPR) in Microsoft Entra ID can be enabled for specific groups, not individual users. This guide confirms that both Security groups and Microsoft 365 groups are valid targets for SSPR configuration.

Choosing C (User1 and Group1) because users mistakenly believe SSPR can be assigned to an individual user account alongside a security group.

Community Discussion (40 comments)

hnk 👍 20 Selected: D

The correct answer is D, you can not assign SSPR to individual users it has to be a group. It can be a Security Group or a M365 Group.

alsmk2 👍 8 Selected: C

Correct. It could be E also, but only if the 365 group was security enabled, and it doesn't mention that in the question.

SabitaN 👍 1 Selected: C

In the Azure portal, you can enable Self-Service Password Reset (SSPR) for both individual users and security groups, but not for Microsoft 365 groups.

932cb77 👍 1 Selected: E

The answer is E Yes you can assign SSPR to individual users via azure portal. Go to the Azure Portal Navigate to Azure Active Directory → Password reset Under "Properties", set: "Self service password reset enabled" = Selected Under "Select users or groups", you can: Select individual users (like [email protected]) Or select groups

Jakub4444 👍 2 Selected: B

Yes, Microsoft Entra's Self-Service Password Reset (SSPR) can be enabled for individual users and security groups, but not directly for Microsoft 365 groups. Important Considerations: Security Groups: SSPR can be enabled for security groups, applying the configuration to all members within those groups. Microsoft 365 Groups: SSPR cannot be directly enabled for Microsoft 365 groups. To apply SSPR settings to users within a Microsoft 365 group, you would need to add those users to a security group and then enable SSPR for that security group. Individual Users: While there's no direct method to enable SSPR for individual users without using groups, you can achieve this by creating a security group specifically for those users and enabling SSPR for that group. https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr?utm_source=chatgpt.com

serbanvadi 👍 2 Selected: D

When you're comfortable with the process and the time is right to communicate the requirements with a broader set of users, you can select a group of users to enable for SSPR. Or, you can enable SSPR for everyone in the Microsoft Entra tenant. https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr#enable-self-service-password-reset

vrm1358 👍 1 Selected: E

Entra ID has 3 options for SSPR, 1- none 2-Group 3- All so we can set SSPR for users and groups

cris_exam 👍 1 Selected: D

Correct Answer D. You can Enable SSPR for Groups (both Security and M365) OR ALL users, but not individual users.

Bravo_Dravel 👍 2 Selected: D

I checked this https://learn.microsoft.com/en-us/training/modules/allow-users-reset-their-password/3-implement-azure-ad-self-service-password-reset and found that to enable self-service password reset (SSPR) for a single user, you must specify a security group. I tested it in the lab, and it also allows an M365 group to be selected for SSPR. Correct Answer is Security Group or a M365 Group

Mitko_V_Milkov 👍 1 Selected: C

The key word here is "enable". You can assign SSPR only to individual user, who you then can put in a group. However, in Azure you can ENABLE either to selected users or users grouped in a security group. Therefore, for me the answer is C.

ZK2000 👍 1 Selected: C

Imo this should be C, as the question states that the subscription only contains the listed user and groups. The article bellow states that we can either enable SSPR for all users (which is only User1 in this case) or for a security group. M365 group is not mentioned. https://learn.microsoft.com/en-us/training/modules/allow-users-reset-their-password/3-implement-azure-ad-self-service-password-reset

SHAHIN_STA 👍 2 Selected: C

You can assign SSPR to individual users and Security Groups, but Microsoft 365 Groups are not supported. Correct answer: C. User1 and Group1 only.

58b2872 👍 1 Selected: D

You cannot enable Self-Service Password Reset (SSPR) for an individual user; it must be done for a group. Currently, you can only enable one Microsoft Entra group for SSPR using the Microsoft Entra admin center. References: Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset Self-service password reset (SSPR) can only be enabled for security groups in Microsoft Entra ID. It cannot be enabled for Microsoft 365 groups. The self-service group management features do not apply to mail-enabled security groups or distribution lists. References:

58b2872 👍 1

58b2872 👍 1 Selected: C

To enable Self-Service Password Reset (SSPR) in Azure, the following conditions apply: --- ### Who can SSPR be enabled for? 1. Individual Users (e.g., User1): - SSPR can be enabled for specific users in Azure AD. 2. Security Groups (e.g., Group1): - SSPR can be enabled for security groups, and all members of the group will inherit the SSPR policy. 3. Microsoft 365 Groups (e.g., Group2): - SSPR cannot be enabled for Microsoft 365 groups. Azure AD does not support enabling SSPR for Microsoft 365 groups. --- ### Analysis of Options: - User1: Eligible for SSPR. - Group1 (Security group): Eligible for SSPR. - Group2 (Microsoft 365 group): Not eligible for SSPR. --- ### Correct Answer:

MarthaMounir 👍 2 Selected: C

User1: Individual user accounts can have Self-Service Password Reset (SSPR) enabled directly. Group1: Security groups can be selected to enable SSPR for all their members. Group2: Microsoft 365 groups are not supported for SSPR configuration.

matthieudumont 👍 2 Selected: C

Vous pouvez activer SSPR pour User1 (utilisateur individuel). Vous pouvez également activer SSPR pour un groupe de sécurité comme Group1. Vous ne pouvez pas activer SSPR pour un groupe Microsoft 365 comme Group2.

KC21 👍 1 Selected: D

You cannot directly enable SSPR for individual users, you must always use a group to manage access.

chrillelundmark 👍 3 Selected: C

https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr Explanation: SSPR can be set to group or users (all). The group has to be a Security group and the question doesn’t state Group2 as a Security group. The question only mention 1 single user All above give that when selecting users, the identity User1 be included. When selecting a group the identity Group1 is the only option.

Josh219 👍 1

Self-service password reset (SSPR) is designed for individual users and security groups, which manage user access and permissions more directly within Azure AD. That's why you can enable SSPR for User1 and Group1 (a security group), but not for Group2 (a Microsoft 365 group).

Mark74 👍 1 Selected: D

D is correct, only groups, not single user

Jaiiee 👍 1 Selected: E

In Microsoft Entra (formerly Azure Active Directory), self-service password reset (SSPR) can be enabled for both individual users and groups (if the group's members are users). Let's break down the identities: User1: This is an individual user, and SSPR can be enabled for this user. Group1: This is a security group. Security groups are typically made up of users, and SSPR can be enabled for all users within this group. Group2: This is a Microsoft 365 group. Although it's a different type of group, it also consists of users, and SSPR can be enabled for the users in this group.

MSLearningStuff 👍 2 Selected: A

The question asks for which identities you can enable SSPR, not which identities you can assign SSPR policies. I think it's poorly structured but given the use of the word "enable", A is the correct answer.

minura 👍 1 Selected: E

Correct Answer is E "Microsoft Entra self-service password reset (SSPR) gives users the ability to change or reset their password, with no administrator or help desk involvement." Ref: https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr

Sholasleek 👍 1

Correct answer is E, when deploying SSPR, even in the testing phase, you can test out with individual user accounts. (E. user1, group1, group2) is the right answer.

Chuong0810 👍 3 Selected: A

Self-Service Password Reset (SSPR) is a feature designed for individual users to reset their own passwords. It's primarily intended for user accounts, not groups. While groups can be used for various administrative tasks, they don't have individual passwords that can be reset. Therefore, you can only enable SSPR for User1 in this scenario.

JPA210 👍 3 Selected: D

Please read here carefully and you can see that you can only use groups, not users. https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr#enable-self-service-password-reset

sabrinakloud 👍 2 Selected: C

sspr not supported for Microsoft 365

Bolthen 👍 3 Selected: D

Tested in personal tenant. Answer is D. You can assign either M365 and Security Groups to the scope of SSPR when set to "Selected". Check subpoint 4: https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr#enable-self-service-password-reset

jamesf 👍 2 Selected: D

You can not assign SSPR to individual users it has to be a group. It can be a Security Group or a M365 Group.

freeacrite 👍 3 Selected: B

Can only be enabled for security groups.

Pisces225 👍 4 Selected: D

You cannot assign SSPR to an individual user. The people saying you can are either simply wrong or intentionally putting bogus info into these comments to make the discussion less helpful.

kejo2 👍 3

Just tried this in my Lab today 2-oct-2024. You can only assign SSPR to Security and Microsoft 365 groups but not to Users account. The answer should be D. Before commenting, please always try it out on your lab.

sahilarora1 👍 1 Selected: E

checked with ChatGPT and Gemini

examprepboy 👍 6

the correct answer is D you CANNOT assign SSPR to a user. it is a feature which is either enabled for ALL or a group

thekrushka 👍 1 Selected: E

I don't know what I'm missing, but I've created clean new 365 group with default settings and I was able to assign SSPR with no problem

[Removed] 👍 1 Selected: C

C is corerct since it´s not mentioned that Microsoft 365 has security-enabled.

pasangawa 👍 2 Selected: C

SSPR can be enabled for individual user accounts as well as security groups. M365 no.

Hash21 👍 2 Selected: A

A. User1 only SSPR can only be enabled for individual users in Azure, not for groups. Group1, which is identified as a "Security group," cannot have Self-Service Password Reset (SSPR) because SSPR is a feature specifically designed for individual user accounts, not for groups.

ELearn 👍 3 Selected: C

1) User1: Can be directly enabled for SSPR because it is an individual user. 2) Group1 (Security Group): Can be enabled for SSPR, and all members of this group would have SSPR capabilities. 3)Group2 (Microsoft 365 Group): As described, it is not security-enabled, so it cannot be configured for SSPR. Standard Microsoft 365 groups do not have direct or indirect support for SSPR unless specified as security-enabled. --------------------------------------------------------------------------

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

When configuring the scope for Self-Service Password Reset (SSPR) in the Azure portal, administrators must choose either 'All' users or 'Selected' groups; individual user accounts cannot be directly assigned to the SSPR policy. The supported group types for the 'Selected' option are Security groups and Microsoft 365 groups. Therefore, Group1 (Security group) and Group2 (Microsoft 365 group) are the correct identities for enabling SSPR.

Why the Other Options Are Wrong

Options A and C are incorrect because you cannot assign an individual user like User1 to the SSPR configuration scope. Option B is incorrect because it excludes Microsoft 365 groups, which are fully supported for SSPR assignment alongside Security groups. Option E is incorrect for the same reason as A and C—individual users cannot be selected.

Community Comment Notes

Several users confirmed that SSPR cannot be assigned to individual users, as hnk noted, "you can not assign SSPR to individual users it has to be a group." Another user validated that both group types work, with Bolthen stating, "You can assign either M365 and Security Groups to the scope of SSPR". Some dissenters mistakenly thought only security groups were valid or that users could be directly assigned.

Official Reference

https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr

Exam Strategy

When asked about SSPR scope assignment, remember that the policy applies to 'All' or 'Selected' groups, never individual users. Ensure you know that both Security groups and Microsoft 365 groups are supported.

Related Analysis

Practice All AZ-104 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-104 Practice Test →

← Back to AZ-104 Study Guide