A service desk lead at Cascade Regional Airlines is designing self-service password reset (SSPR) for outstation employees so they can regain access to their accounts without calling the help desk after hours. Before enabling SSPR, what must the lead configure so users actually have a way to verify their identity during a reset?
Select an answer to reveal the explanation.
Short Explanation
SSPR only works if there's something to check the user against — think of it like a locked door with a keypad: useless until someone actually sets a code. Authentication methods are that code, so users have to register them before the reset flow has anything to verify.
Full Explanation
Self-service password reset relies on one or more registered authentication methods — a mobile authenticator app, a phone number for SMS or voice call, security questions, or email — that Entra ID checks during a reset attempt to confirm the user's identity. The mechanism is proof-of-identity via a channel outside the forgotten password itself, and that channel has to exist before the outstation employee ever needs it, which is why registration is required up front, often enforced at first sign-in. Disabling multi-factor authentication doesn't enable SSPR at all; it actually removes a layer of protection and has nothing to do with letting users reset passwords themselves. Granting Global Administrator is wildly excessive and a serious security anti-pattern — password reset for one's own account never requires a tenant-wide admin role. Blocking sign-ins from outstation locations would prevent the very employees the lead is trying to help from reaching the reset page at all. A caveat worth flagging for the exam: SSPR policy lets an admin require a minimum number of methods (commonly two) before a reset is permitted. An operational check is having a test user register methods and then walk through a reset from an unauthenticated browser session to confirm the flow actually completes.