Valid SSPR Authentication Methods with Single Method Requirement

Answer Correct answer: D — An email to an address outside your organization is a valid authentication method for Self-Service Password Reset in Microsoft Entra ID.

You have a Microsoft Entra tenant. You configure self-service password reset (SSPR) by using the following settings: • Require users to register when signing in: Yes • Number of methods required to reset: 1 What is a valid authentication method available to users?

a mobile app notification
an FIDO2 security token
a Microsoft Teams chat
an email to an address outside your organization Correct Answer

microsoft entra id sspm self service password reset methods sc-300 exam practice valid authentication methods

Community Votes

82%

18%

82% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests the specific configuration constraints of SSPR where 'Require users to register' is enabled with a count of 1, highlighting that external email is a supported fallback method.

Determines which authentication method is valid for Microsoft Entra ID Self-Service Password Reset (SSPR) when only one method is required. The correct answer is an email to an address outside your organization.

Many candidates choose Mobile App Notification because it is a primary modern method, but they fail to consider that some exam questions imply legacy or specific admin configurations where external email is the only available option.

Community Discussion (5 comments)

perkp 👍 5 Selected: D

Just tested in Azure portal. When you choose only 1 authentication method Mobile app notification is grayed out, and Email is the only of the options that are available.

YesPlease 👍 1 Selected: A

Answer A) a mobile app notification (This is the only one that can be used from this particular list) Remember, the settings says they have to REGISTER at least one method...but the backend admin may have setup more than one authentication method to register with. The following authentication methods are available for SSPR: - Mobile app notification (this is valid if the admin setup more than one method to authenticate) - Mobile app code (valid for one method only scenario) - Email (*Has to be to their company email address and not external) - Mobile phone - Office phone (available only for tenants with paid subscriptions) - Security questions https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks#authentication-methods

59e8fdb 👍 1 Selected: A

109 is exactly the same question with completely different answer here, wtf?

Gmobilize 👍 2 Selected: D

So from many sets of questions we assume it's D, but literally a few questions up we have the same question with a different answer - "mobile app notification", why is that?

ethhacker 👍 2 Selected: D

D only available in Azure

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The question asks for a valid authentication method in a scenario where users must register and are required to use only one method to reset their password. While Microsoft Entra ID supports multiple methods including the Authenticator app, FIDO2, and phone calls, the specific constraint here often points to Email as the fundamental, universally available fallback method. In many exam contexts, unless the Authenticator app is explicitly mentioned as configured in the tenant's default settings, Email (including secondary emails) is considered a standard, valid method for registration and reset. Option D specifies 'an email to an address outside your organization,' which refers to a secondary email address added to the user's profile, a common and valid SSPR method.

Why the Other Options Are Wrong

Option A (Mobile app notification) is a valid method, but it requires the Microsoft Authenticator app to be installed and configured on the user's device. If the question implies a minimal setup or lacks mention of the app being pre-configured, it might not be the 'guaranteed' valid method compared to email. However, in many modern exams, A is also considered correct if the app is assumed. The conflict arises from ambiguous question wording. Option B (FIDO2 security token) is a valid method but less common for general self-service resets without specific hardware deployment. Option C (Microsoft Teams chat) is NOT a valid SSPR authentication method; Teams does not support sending OTPs or notifications for password reset.

Community Comment Notes

Community consensus heavily favors D, with comments noting that in certain portal configurations, other methods may appear grayed out or unavailable if not explicitly enabled by the admin. One commenter noted that testing in the Azure portal showed Email as the only available option when specific conditions were met. Another comment highlighted confusion due to similar questions having different answers, suggesting that context regarding admin configuration is key. The vote distribution strongly supports D, indicating that this specific phrasing targets the email-based fallback mechanism.

Exam Strategy

When dealing with SSPR questions, always check if the question specifies that the Microsoft Authenticator app is configured or required. If not, assume that basic methods like Email (secondary) or Phone are available. Be wary of options like 'Teams Chat' which are never valid for SSPR.

Frequently Asked Questions

Why is Mobile App Notification not the best answer?

While valid, it requires the Authenticator app to be installed. Exam questions often prioritize Email as the universal fallback if app configuration isn't explicitly stated.

Can Microsoft Teams be used for SSPR?

No, Microsoft Teams is not an authentication method for Self-Service Password Reset in Microsoft Entra ID.

Related Analysis

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide