Microsoft Certified Security Compliance And Identity Fundamentals · Free Practice Question Easy
Question 41
Scenario: You are working as a consultant at Avengers Security. At the moment, you are consulting with Tony, the lead of the IT team and the topic of discussion is Azure security.
The IT department at Avengers Security has been asked to find ways to reduce IT costs, without compromising security.
Which feature should they consider implementing?
-
A
FIDO2
-
B
Multifactor authentication
-
C
Biometric sign-in on all devices
-
D
Self-service password reset
Reveal correct answer
Correct answer: D
Explanation
Self-service password reset allows users to change or reset their own passwords, thereby reducing the cost of providing administrators and help desk personnel.
Self-service password reset (SSPR) in Azure AD
Self-service password reset (SSPR) is a feature of Azure AD that allows users to change or reset their password, without administrator or help desk involvement.
If a user's account is locked or they forget the password, they can follow a prompt to reset it and get back to work. Self-service password reset has several benefits:
• It increases security, as help desks add an extra security layer.
• It saves the organization money by reducing the number of calls and requests to help desk staff.
• It increases productivity, allowing the user to return to work faster.
Self-service password reset works in the following scenarios:
• Password change: when a user knows their password but wants to change it to something new.
• Password reset: when a user can't sign in, such as when they forget the password, and want to reset it.
• Account unlock: when a user can't sign in because their account is locked out.
To use self-service password reset, users must be:
• Assigned an Azure AD license. See Licensing requirements for Azure Active Directory self-service password reset in the Learn More section below.
• Enabled for SSPR by an administrator.
• Registered, with the authentication methods they want to use. Two or more authentication methods are recommended in case one is unavailable.
The following authentication methods are available for SSPR:
• Mobile app notification
• Mobile app code
• Mobile phone
• Office phone
• Security questions
Note: By default, administrator accounts are enabled for self-service password reset and are required to use two authentication methods to reset their password, such as an email address, authenticator app, or a phone number. Administrators don't have the ability to use security questions.
When a user resets their password using self-service password reset, it can also be written back to an on-premises Active Directory. Password write-back allows users to use their updated credentials with on-premises devices and applications without a delay.
To keep users informed about account activity, admins can configure email notifications to be sent when an SSPR event happens. These notifications can cover both regular user accounts and admin accounts. For admin accounts, this notification provides an extra layer of awareness when a privileged administrator account password is reset using SSPR. All global admins would be notified when SSPR is used on an admin account.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
