Cascade Regional Airlines' service desk lead is configuring self-service password reset policy and wants to require that a user register at least two different authentication methods, and that both methods be used together when performing a reset, for stronger assurance. Where is this requirement configured?

The Microsoft Entra ID SSPR authentication methods policy includes a setting for the number of methods required to reset a password — an admin can set this to one or two, and when set to two, a user must successfully verify through two distinct registered methods (for example, an authenticator app notification plus a phone call) before the reset is permitted, which is the exact stronger-assurance requirement described. That setting lives specifically in the SSPR policy blade alongside which methods (authenticator app, phone, security questions, email) are enabled and how many a user must register. A named location policy under Conditional Access controls sign-in access based on network location — it has no setting for how many methods SSPR requires during a reset. Assigning a second administrative role to the user is unrelated to authentication method requirements and would instead change what that user is permitted to administer in the tenant, which is a governance risk if done carelessly. Adding the user to a second security group affects group-based access or licensing, not the number of methods SSPR demands during a reset flow. An exam-relevant caveat: increasing the required number of methods only has teeth if users have actually registered at least that many methods, so combining it with a registration-enforcement policy at first sign-in matters operationally. An operational check is attempting a test reset and confirming the flow prompts for two separate verifications before allowing a new password.