Valid SSPR Authentication Method When Only One Reset Method Is Required

Why the Answer Is Correct

With SSPR enabled, 'Require users to register when signing in' set to Yes, and 'Number of methods required to reset' set to 1, each user needs exactly one working verification path — and an email to an address outside your organization qualifies. Microsoft's SSPR method list includes Email, which delivers a verification code to an alternate address the user controls and can still reach while locked out of the tenant. Because a single method is sufficient, one registered external email address lets the user reset without a second method ever being prompted. An address outside the organization is the intended target for that method: the reset code must be retrievable by someone who cannot sign in, which the mailbox behind the forgotten password is not. Choosing A therefore matches both the documented method inventory and the specific one-method setting configured in the scenario.

Why the Other Options Are Wrong

Option B (mobile app notification) fails directly on the question's configuration: Microsoft's SSPR guidance states that when administrators require one method be used, 'verification code is the only option available' for the Authenticator app, and notification becomes selectable only when two methods are required. Option C (smartcard) is not an SSPR method at all — smartcards are a sign-in credential, while SSPR is limited to mobile app notification, mobile app code, email, mobile phone, office phone, and security questions. Option D (email to an address in your organization) is excluded for the same reason the external address is required: a work mailbox inside the tenant is the resource protected by the password being reset, so the user cannot open it to collect the code while locked out. Option A is the only choice that both exists as an SSPR method and survives the one-method restriction.

Community Comment Notes

nicolaslindt cited the SSPR documentation and reasoned that 'verification code is the only option available' for the app path when a single method is required, which supports A over B. rvln7 repeated the same documentation sentence and added the reverse case — with two methods required, users 'are able to use notification OR verification code' — confirming notification is gated behind the two-method setting. Btn26 argued for option B, calling mobile app notification a commonly used SSPR verification method, which is true in general but not under this tenant's one-method configuration. The vote split, with A clearly ahead of B, reflects exactly that notification-versus-code confusion among learners.