Enable SSPR for Entra Identities

AZ-104 Last updated

Manage Microsoft Entra users and groups

Short answer

D You can enable SSPR for Group1 and Group2 because SSPR scope requires Security or Microsoft 365 groups, not individual users.

Question

You have an Azure subscription that contains the Microsoft Entra identities shown in the following table. You need to enable self-service password reset (SSPR). For which identities can you enable SSPR in the Azure portal? - Exhibit: Enable SSPR for Entra Identities

  1. User1 only
  2. Group1 only
  3. User1 and Group1 only
  4. Group1 and Group2 only Correct Answer
  5. User1, Group1, and Group2

Key Takeaways

SSPR scope configuration requires assigning groups (Security or Microsoft 365), not individual user accounts, which is a common trap for those assuming direct user assignment.

Self-service password reset (SSPR) in Microsoft Entra ID can be enabled for specific groups, not individual users. This guide confirms that both Security groups and Microsoft 365 groups are valid targets for SSPR configuration.

Common mistake: Choosing C (User1 and Group1) because users mistakenly believe SSPR can be assigned to an individual user account alongside a security group.

Expert Analysis

Why the Answer Is Correct

When configuring the scope for Self-Service Password Reset (SSPR) in the Azure portal, administrators must choose either 'All' users or 'Selected' groups; individual user accounts cannot be directly assigned to the SSPR policy. The supported group types for the 'Selected' option are Security groups and Microsoft 365 groups. Therefore, Group1 (Security group) and Group2 (Microsoft 365 group) are the correct identities for enabling SSPR.

Why the Other Options Are Wrong

Options A and C are incorrect because you cannot assign an individual user like User1 to the SSPR configuration scope. Option B is incorrect because it excludes Microsoft 365 groups, which are fully supported for SSPR assignment alongside Security groups. Option E is incorrect for the same reason as A and C—individual users cannot be selected.

Community Comment Notes

Several users confirmed that SSPR cannot be assigned to individual users, as hnk noted, "you can not assign SSPR to individual users it has to be a group." Another user validated that both group types work, with Bolthen stating, "You can assign either M365 and Security Groups to the scope of SSPR". Some dissenters mistakenly thought only security groups were valid or that users could be directly assigned.

Official Reference

https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr

Exam Strategy

When asked about SSPR scope assignment, remember that the policy applies to 'All' or 'Selected' groups, never individual users. Ensure you know that both Security groups and Microsoft 365 groups are supported.

Community Votes

D
58%
C
42%

58% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 40 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.

From public community threads 30 of 40

  1. hnk 👍 20 Answered D
    The correct answer is D, you can not assign SSPR to individual users it has to be a group. It can be a Security Group or a M365 Group.
  2. alsmk2 👍 8 Answered C
    Correct. It could be E also, but only if the 365 group was security enabled, and it doesn't mention that in the question.
  3. examprepboy 👍 6
    the correct answer is D you CANNOT assign SSPR to a user. it is a feature which is either enabled for ALL or a group
  4. Pisces225 👍 4 Answered D
    You cannot assign SSPR to an individual user. The people saying you can are either simply wrong or intentionally putting bogus info into these comments to make the discussion less helpful.
  5. ELearn 👍 3 Answered C
    1) User1: Can be directly enabled for SSPR because it is an individual user. 2) Group1 (Security Group): Can be enabled for SSPR, and all members of this group would have SSPR capabilities. 3)Group2 (Microsoft 365 Group): As described, it is not security-enabled, so it cannot be configured for SSPR. Standard Microsoft 365 groups do not have direct or indirect support for SSPR unless specified as security-enabled. --------------------------------------------------------------------------
Show 25 more comments
  1. chrillelundmark 👍 3 Answered C
    https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr Explanation: SSPR can be set to group or users (all). The group has to be a Security group and the question doesn’t state Group2 as a Security group. The question only mention 1 single user All above give that when selecting users, the identity User1 be included. When selecting a group the identity Group1 is the only option.
  2. Chuong0810 👍 3 Answered A
    Self-Service Password Reset (SSPR) is a feature designed for individual users to reset their own passwords. It's primarily intended for user accounts, not groups. While groups can be used for various administrative tasks, they don't have individual passwords that can be reset. Therefore, you can only enable SSPR for User1 in this scenario.
  3. Bolthen 👍 3 Answered D
    Tested in personal tenant. Answer is D. You can assign either M365 and Security Groups to the scope of SSPR when set to "Selected". Check subpoint 4: https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr#enable-self-service-password-reset
  4. kejo2 👍 3
    Just tried this in my Lab today 2-oct-2024. You can only assign SSPR to Security and Microsoft 365 groups but not to Users account. The answer should be D. Before commenting, please always try it out on your lab.
  5. JPA210 👍 3 Answered D
    Please read here carefully and you can see that you can only use groups, not users. https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr#enable-self-service-password-reset
  6. freeacrite 👍 3 Answered B
    Can only be enabled for security groups.
  7. Jakub4444 👍 2 Answered B
    Yes, Microsoft Entra's Self-Service Password Reset (SSPR) can be enabled for individual users and security groups, but not directly for Microsoft 365 groups. Important Considerations: Security Groups: SSPR can be enabled for security groups, applying the configuration to all members within those groups. Microsoft 365 Groups: SSPR cannot be directly enabled for Microsoft 365 groups. To apply SSPR settings to users within a Microsoft 365 group, you would need to add those users to a security group and then enable SSPR for that security group. Individual Users: While there's no direct method to enable SSPR for individual users without using groups, you can achieve this by creating a security group specifically for those users and enabling SSPR for that group. https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr?utm_source=chatgpt.com
  8. Bravo_Dravel 👍 2 Answered D
    I checked this https://learn.microsoft.com/en-us/training/modules/allow-users-reset-their-password/3-implement-azure-ad-self-service-password-reset and found that to enable self-service password reset (SSPR) for a single user, you must specify a security group. I tested it in the lab, and it also allows an M365 group to be selected for SSPR. Correct Answer is Security Group or a M365 Group
  9. serbanvadi 👍 2 Answered D
    When you're comfortable with the process and the time is right to communicate the requirements with a broader set of users, you can select a group of users to enable for SSPR. Or, you can enable SSPR for everyone in the Microsoft Entra tenant. https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr#enable-self-service-password-reset
  10. Hash21 👍 2 Answered A
    A. User1 only SSPR can only be enabled for individual users in Azure, not for groups. Group1, which is identified as a "Security group," cannot have Self-Service Password Reset (SSPR) because SSPR is a feature specifically designed for individual user accounts, not for groups.
  11. MarthaMounir 👍 2 Answered C
    User1: Individual user accounts can have Self-Service Password Reset (SSPR) enabled directly. Group1: Security groups can be selected to enable SSPR for all their members. Group2: Microsoft 365 groups are not supported for SSPR configuration.
  12. matthieudumont 👍 2 Answered C
    Vous pouvez activer SSPR pour User1 (utilisateur individuel). Vous pouvez également activer SSPR pour un groupe de sécurité comme Group1. Vous ne pouvez pas activer SSPR pour un groupe Microsoft 365 comme Group2.
  13. MSLearningStuff 👍 2 Answered A
    The question asks for which identities you can enable SSPR, not which identities you can assign SSPR policies. I think it's poorly structured but given the use of the word "enable", A is the correct answer.
  14. SHAHIN_STA 👍 2 Answered C
    You can assign SSPR to individual users and Security Groups, but Microsoft 365 Groups are not supported. Correct answer: C. User1 and Group1 only.
  15. jamesf 👍 2 Answered D
    You can not assign SSPR to individual users it has to be a group. It can be a Security Group or a M365 Group.
  16. pasangawa 👍 2 Answered C
    SSPR can be enabled for individual user accounts as well as security groups. M365 no.
  17. sabrinakloud 👍 2 Answered C
    sspr not supported for Microsoft 365
  18. 58b2872 👍 1 Answered C
    To enable Self-Service Password Reset (SSPR) in Azure, the following conditions apply: --- ### Who can SSPR be enabled for? 1. Individual Users (e.g., User1): - SSPR can be enabled for specific users in Azure AD. 2. Security Groups (e.g., Group1): - SSPR can be enabled for security groups, and all members of the group will inherit the SSPR policy. 3. Microsoft 365 Groups (e.g., Group2): - SSPR cannot be enabled for Microsoft 365 groups. Azure AD does not support enabling SSPR for Microsoft 365 groups. --- ### Analysis of Options: - User1: Eligible for SSPR. - Group1 (Security group): Eligible for SSPR. - Group2 (Microsoft 365 group): Not eligible for SSPR. --- ### Correct Answer:
  19. 58b2872 👍 1 Answered D
    You cannot enable Self-Service Password Reset (SSPR) for an individual user; it must be done for a group. Currently, you can only enable one Microsoft Entra group for SSPR using the Microsoft Entra admin center. References: Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset Self-service password reset (SSPR) can only be enabled for security groups in Microsoft Entra ID. It cannot be enabled for Microsoft 365 groups. The self-service group management features do not apply to mail-enabled security groups or distribution lists. References:
  20. Jaiiee 👍 1 Answered E
    In Microsoft Entra (formerly Azure Active Directory), self-service password reset (SSPR) can be enabled for both individual users and groups (if the group's members are users). Let's break down the identities: User1: This is an individual user, and SSPR can be enabled for this user. Group1: This is a security group. Security groups are typically made up of users, and SSPR can be enabled for all users within this group. Group2: This is a Microsoft 365 group. Although it's a different type of group, it also consists of users, and SSPR can be enabled for the users in this group.
  21. ZK2000 👍 1 Answered C
    Imo this should be C, as the question states that the subscription only contains the listed user and groups. The article bellow states that we can either enable SSPR for all users (which is only User1 in this case) or for a security group. M365 group is not mentioned. https://learn.microsoft.com/en-us/training/modules/allow-users-reset-their-password/3-implement-azure-ad-self-service-password-reset
  22. 58b2872 👍 1
    You cannot enable Self-Service Password Reset (SSPR) for an individual user; it must be done for a group. Currently, you can only enable one Microsoft Entra group for SSPR using the Microsoft Entra admin center. References: Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset
  23. 932cb77 👍 1 Answered E
    The answer is E Yes you can assign SSPR to individual users via azure portal. Go to the Azure Portal Navigate to Azure Active Directory → Password reset Under "Properties", set: "Self service password reset enabled" = Selected Under "Select users or groups", you can: Select individual users (like [email protected]) Or select groups
  24. Josh219 👍 1
    Self-service password reset (SSPR) is designed for individual users and security groups, which manage user access and permissions more directly within Azure AD. That's why you can enable SSPR for User1 and Group1 (a security group), but not for Group2 (a Microsoft 365 group).
  25. minura 👍 1 Answered E
    Correct Answer is E "Microsoft Entra self-service password reset (SSPR) gives users the ability to change or reset their password, with no administrator or help desk involvement." Ref: https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Assigning Fabric Licenses in Entra ID Free Tenant

S-Grade

Which Certificate from Vault1 for WebApp1 TLS?

S-Grade

Does Storage Account Encryption Scope Contributor Role Allow Key Regeneration?

S-Grade

Practice All AZ-104 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-104 Practice Test →

← Back to AZ-104 Study Guide