Relecloud wants to enable Self-Service Password Reset (SSPR) for all users in the organization. Their security policy requires that users verify their identity using at least TWO methods before being allowed to reset their password. The IT team wants to give users flexibility by offering mobile app notification, email, and security questions as available options. What is the correct minimum configuration in the SSPR settings to meet this requirement?
Select an answer to reveal the explanation.
Short Explanation and Infographic
SSPR is like a bank's identity verification at the teller — the bank decides how many ID documents you need to show before they'll help you. Setting the required methods to 2 and offering multiple options (app notification, email, security questions) means users must prove identity twice, but they get to pick which two methods they've registered.
Full explanation below image
Full Explanation
Microsoft Entra SSPR is configured under Protection > Password reset. The key setting 'Number of methods required to reset' controls how many verification steps a user must complete before a password reset is allowed. Setting this to 2 means a user must successfully complete two distinct verification challenges. You then enable the methods users can register and use: Mobile app notification (Microsoft Authenticator push), Email (to an alternate email address), Security questions, Mobile app code, Mobile phone, and Office phone are all available options. The scenario specifically asks for mobile app notification, email, and security questions — enabling all three gives users flexibility to register and use any two of them.
Option A is incorrect because setting the requirement to 1 method fails the security policy requiring TWO methods. Even if the Authenticator app is strong, requiring only one factor is a weaker configuration than the policy demands.
Option C is incorrect because deploying SSPR to a pilot group only is a rollout strategy decision, not a configuration for the authentication method requirement. The question asks what configuration meets the security policy, not what deployment approach to use. Rolling out to all users is specifically stated as the goal.
Option D is incorrect because SSPR does not support a 'Helpdesk call' as one of its built-in verification methods. SSPR's purpose is to eliminate the helpdesk call for routine resets; requiring a helpdesk call defeats the feature's entire value proposition and is not a configurable SSPR method in Entra ID.
Exam tip: Know the difference between the number of methods required (1 or 2, controlled by the 'Number of methods required to reset' setting) and which methods are available. You configure them independently. Also note that security questions require users to have registered answers in advance — they cannot be used if not pre-registered.