Microsoft Entra Licenses and SSPR: 10 practice questions

Question 1 of 10

What is the default value of the Self-service password reset enabled property?

1. ANone
2. BSelected
3. CTwo methods
4. DAll

Question 2 of 10

Where are individual and group license assignments managed?

1. AMicrosoft Entra admin center under Users > Deleted users
2. BAzure portal under Directory + Subscription > Switch directory
3. CMicrosoft Entra admin center under Password reset > Properties
4. DMicrosoft 365 admin center, under the Billing > Licenses page

Question 3 of 10

Which SSPR scope enables password reset for members of one specified security group?

1. ASelected
2. BAll
3. CNone
4. DRegistration

Question 4 of 10

A user receives the same product license directly and from two licensed groups. How many times is that license consumed for the user?

1. AZero times
2. BThree times
3. CTwice
4. DOne license

Question 5 of 10

What location is used during group license assignment when a user has no usage location specified?

1. ASign-in location
2. BThe license purchaser's location
3. CThe directory's location
4. DThe group's owner's location

Question 6 of 10

How does SSPR authentication differ for an account associated with an administrator role?

1. AIt requires only an office-phone call and excludes Authenticator methods.
2. BIt bypasses identity verification when the password is expired.
3. CIt always requires two methods and cannot use security questions.
4. DIt follows the one-method user setting and can use security questions alone.

Question 7 of 10

Which SSPR notification setting alerts the wider administrative team about a peer's password reset?

1. ASend every user a notification when any non-administrator resets a password.
2. BRequire authentication-information reconfirmation.
3. CNotify all admins when other admins reset their password.
4. DNotify users on password resets at their primary and secondary email addresses.

Question 8 of 10

A department's licenses must follow membership automatically, and one service plan in the product must remain disabled until launch. Which configuration meets both requirements?

1. AAssign the product directly to the group owner and let members inherit the owner's license.
2. BAssign the product to a security group and leave every service plan enabled for all members.
3. CAssign the product directly to every current user and remove the service plan from the product catalog.
4. DAssign the product to a security group and disable that service plan in the group assignment.

Question 9 of 10

An organization is piloting SSPR with one security group, requires two proofs for an administrator in that group, and does not permit that administrator to use security questions. Which configuration is valid?

1. ASet scope to Selected for the group; the administrator uses two non-security-question methods.
2. BKeep scope at None; the administrator uses two methods because administrator policy bypasses scope.
3. CSet scope to All; the administrator uses one security question and one email method.
4. DSet scope to Selected for the group; the administrator uses security questions as both methods.

Question 10 of 10

A hybrid organization needs password writeback for users in an existing on-premises domain and for users in a disconnected domain added through a merger. Both populations must coexist during deployment. Which design fits?

1. AUse Microsoft Entra Connect for one domain and cloud sync for the other, side by side.
2. BUse SSPR notifications for one domain and security questions as writeback for the other.
3. CUse Microsoft Entra Connect for both populations through one mandatory deployment instance.
4. DUse cloud sync and disable disconnected-domain writeback.