Microsoft AZ-104 Exam Dumps, Practice Test Questions

The All setting grants self-service password-reset eligibility across the tenant instead of limiting it to the pilot security group. Conditional Access policies address sign-in access, and a communication restriction is not an SSPR eligibility rule. The organization would lose its controlled pilot boundary even if it told only pilot members to use the workflow.

The Authentication methods policy can target groups for particular recovery and sign-in methods, but it does not replace the separate SSPR Properties setting that determines who is eligible to reset a password. Enabling SSPR for All would include employees outside the approved pilot, even if their available methods differed from those of the pilot population.

None disables the SSPR reset flow for all employees, including members of the pilot group. Registering security information prepares users for future authentication but does not independently enable self-service password reset when the SSPR eligibility setting excludes them. The pilot requires Selected, not a registration-only campaign.

Password hash synchronization normally sends on-premises password hashes toward Microsoft Entra ID to support cloud sign-in. It does not reverse the password-flow direction after a user performs SSPR in the cloud. Even if that synchronization works perfectly, on-premises authentication can continue to use the previous password until a supported writeback operation succeeds.

Increasing the verification-method requirement changes how a person proves identity before a reset, not which directory receives the resulting password. Two strong methods can protect an SSPR event but cannot write its outcome into AD DS when the required hybrid password-writeback feature is disabled or misconfigured.

Ordinary user-attribute synchronization does not represent a completed password-writeback operation. Attributes and credentials have different synchronization pathways and security controls. A cloud-originated password reset needs the supported hybrid writeback configuration; repeatedly syncing display names or group membership will not repair the stale on-premises password.

A two-method reset requirement raises the amount of verification needed when recovering an account, but it does not enroll either method for an employee who has never registered. Without a supported enrollment prompt, the pilot can encounter users who are eligible for SSPR but unable to meet the recovery challenge when needed.

The reconfirmation interval is for checking the currency of previously registered contact information, and Microsoft documents that reconfirmation depends on the registration-at-sign-in feature being enabled. Setting only the interval therefore does not establish the initial collection flow for employees with no SSPR recovery methods.

The notify-users setting sends awareness email after a reset operation, not a sign-in registration prompt. It cannot collect a recovery phone number or other approved authentication method before the employee loses access. The organization needs a deliberate enrollment control rather than an event notice that occurs after recovery.

Expanding the allowed-method list is useful only if the employee actually registers another eligible method. The configured policy still requires two successful independent challenges at reset time; an expanded catalog does not transform the one enrolled email address into two pieces of verification evidence. Enrollment is the missing prerequisite.

A reset-notification email is sent to increase awareness after a credential change; it is not a second registered, successfully completed authentication challenge during recovery. Treating a notice as a proof method would undermine the organization's two-method policy and leave the original enrollment deficit unresolved.

Reconfirmation timing controls when users are asked to review recovery information already on file. Lengthening that interval neither creates a new registered method nor changes the two independent verification challenges required for this employee. The help desk must address method enrollment, not the reminder schedule.

The notify-users setting informs the account owner when that account's password is reset. It is distinct from the dedicated administrator-notification setting that sends alerts to other administrators when an admin resets their own password.

Password writeback is useful in a hybrid environment when a password reset initiated in Microsoft Entra must also update the linked on-premises Active Directory account. That synchronization mechanism cannot send notifications to other administrators. The scenario does not describe an on-premises password mismatch or connector failure, so adding writeback would leave the privileged reset alert requirement unmet.

SSPR registration establishes recovery methods. Requiring administrator registration does not turn on notifications to other administrators after a privileged user's password reset; the separate admin notification switch is required.

Notifying all administrators when an administrator performs an SSPR password reset is an important privileged-account alert, but this case concerns ordinary employees detecting resets of their own accounts. An administrator-only reset notification does not substitute for an event message to the affected employee. Both notifications can be enabled, yet the employee-specific setting is the one required by the stated incident reports.

A custom helpdesk URL is displayed to users seeking assistance during SSPR enrollment or recovery and can route them to a company support portal. It is useful when users cannot verify themselves, but it does not generate email when a successful reset occurs. The security policy requires event-driven confirmation after account credentials change, not merely a help link on the reset page.

Password writeback allows supported synchronized hybrid users to change passwords in Microsoft Entra and have the update sent to on-premises Active Directory. A cloud-only account has no corresponding on-premises password to update, and writeback does not govern user email notifications. Enabling it here would not inform an employee that a potentially unauthorized self-service password reset succeeded.

Reducing the required verification method count changes the security threshold for the reset operation. It neither edits the destination of Contact your administrator nor gives someone who needs human support a usable corporate portal URL. The team specifically wants a support-routing change without weakening the password recovery policy.

A reset-notification setting sends messages when a password reset succeeds; a user who is stuck before completion needs an assistance destination instead. Leaving the custom helpdesk field blank cannot change the link to the corporate portal, even if notifications are configured correctly elsewhere in SSPR.

A reconfirmation interval asks already enrolled users to verify that their recovery contact information remains current. It does not configure the link presented when a person clicks Contact your administrator. Setting the interval to zero can stop periodic reconfirmation, but it will not establish the required support portal destination.

Requiring two proofs instead of one strengthens the reset verification ceremony but does not cause users to periodically reconfirm the phone or email records they registered earlier. The requirement is about the age and reconfirmation of authentication information, which is controlled by the SSPR registration reconfirmation interval, not the number of methods at reset time.

MFA sign-in session lifetime affects how frequently an application or identity provider requires authentication again. It does not set the interval at which users reconfirm phone numbers, email addresses and other registered SSPR recovery information. Even frequent sign-in challenges would not guarantee the help desk has current reset methods, because the two settings govern different Entra registration and authentication processes.

Initial recovery-method registration ensures a user has enrolled approved factors at onboarding, but it does not schedule later confirmation that those methods still work. Employees can change phone numbers or email access after the initial registration. Leaving the reconfirmation interval unset or ineffective means the intended periodic contact validation is not performed, even when the initial enrollment step succeeded.

Password writeback supports sending eligible Microsoft Entra password changes into on-premises Active Directory, but the option explicitly leaves self-unlock without a password reset disabled. The employees know their passwords; their problem is an on-premises account lockout flag. Simply enabling writeback while keeping the separate unlock-only functionality unavailable does not deliver the requested recovery experience.

Sending a lockout notification can alert employees or help-desk staff to account events, but email does not clear a locked user account in on-premises Active Directory. The underlying lockoutTime state remains and authentication can still fail. The scenario calls for self-service clearing of a lockout without changing the existing password; that requires the supported hybrid unlock integration, not only event reporting.

A forced password reset may incidentally unlock an account in supported environments, but the case expressly asks to keep the user’s known valid password. Requiring a different password on each lockout increases help-desk and user disruption while disregarding the underlying on-premises account unlock capability. It is the wrong workflow when password compromise or expiration is not the reason for the failed sign-in.

SSPR scope controls which eligible users can use self-service reset, but extending scope cannot waive the on-premises privileged-administrator restriction. This account is protected because its on-premises directory role is highly sensitive. Enabling SSPR broadly would also expose the portal to more ordinary users without solving the privileged reset.

Password hash synchronization copies supported on-premises credential hashes toward Entra for sign-in; it doesn't turn cloud SSPR into an allowed recovery mechanism for restricted on-premises administrators. Waiting for a synchronization cycle cannot override the administrator exception. The password must be recovered using the permitted on-premises operation.

Microsoft 365 licensing affects application/service entitlements, not the restriction on cloud password reset for on-premises Enterprise Admin identities. Adding a license would neither prove privileged identity ownership nor authorize SSPR for this protected account. The recovery path is a controlled AD DS administrative reset.

Scoping the administrator into an ordinary-user SSPR group does not remove the separate administrator reset policy. In this established tenant the administrator must satisfy the privileged two-gate reset checks even when ordinary users are allowed a one-method flow. Group inclusion can govern whether users are enabled for a standard user policy, not rewrite the administrator-specific verification standard.

The administrator-specific SSPR policy does not depend on the tenant Authentication methods policy in the same way as ordinary user method availability. Disabling a method there does not change the required two separate authentication data gates for this Global Administrator. It might affect other sign-in or registration experiences instead, without solving the requested privileged reset-policy restriction.

The stronger standard administrator reset policy generally requires two pieces of authentication data, not an unconditional three. The question specifies a verified-domain established tenant, so the normal two-gate rule rather than a new-trial one-gate exception applies. Requiring exactly three would invent a threshold that this Microsoft Entra SSPR scenario does not support.