What's changed: Created MS-102 Chapter 2 (domain: Microsoft Entra identity and access): identity synchronization (IdFix pre-remediation, Microsoft Entra Connect Sync vs Cloud Sync, Connect Health monitoring, troubleshooting), authentication (authentication methods, SSPR, Password Protection global/custom banned lists, password writeback), and secure access (Identity Protection risk detection and risk policies, Conditional Access signals and grant/block, enforcing MFA via Conditional Access, require compliant device).
2.2Authentication
Understand managing authentication methods, self-service password reset (SSPR), Microsoft Entra Password Protection to block weak/banned passwords, and investigating authentication issues.
Sign-in security improves by combining authentication methods, user self-recovery of passwords, and eliminating weak passwords—each with a distinct role.
2.2.1Authentication methods and SSPR
In authentication methods, enable/control available factors such as Microsoft Authenticator, FIDO2 security keys, phone, and OATH tokens. Self-service password reset (SSPR) lets users reset their own password using registered methods, reducing help-desk load (password writeback is needed to reflect on-prem).
2.2.2Password Protection
Microsoft Entra Password Protection blocks weak/guessable/banned passwords. Beyond Microsoft’s global banned password list, you can set an org-specific custom banned password list (company/product names) and extend it to on-prem AD. Whereas SSPR is "a way for users to reset," Password Protection enforces the quality of passwords that can be set.
Cues: "enable available factors (Authenticator/FIDO2/phone)" = authentication methods. "users reset their own password" = SSPR. "block weak/banned passwords, custom banned list" = Password Protection. SSPR reflecting on-prem = password writeback.
Watch the mix-ups: (1) SSPR (a reset mechanism for users) vs Password Protection (enforcing password quality). (2) Authentication methods (enabling factors) underpin SSPR/MFA but are a separate setting. (3) Custom banned password list = Password Protection. (4) Reflecting SSPR on-prem needs password writeback.
2.2.3Section summary
- Authentication methods enable/control factors like Authenticator/FIDO2/phone
- SSPR lets users reset their own password (on-prem needs writeback)
- Password Protection blocks weak/banned passwords (global + custom banned lists)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To reduce help-desk calls, you want users to securely reset their own password using registered methods. Best?
Q2. You want to block users from setting guessable passwords containing company/product names. Best?
Q3. You want to enable Microsoft Authenticator and FIDO2 security keys as factors users can use for MFA/SSPR. Where do you configure this?
Q4. After SSPR resets the cloud password, the on-prem AD password isn’t updated. What configuration is needed?
Q5. "Self-recovery when users forget passwords" and "enforcing the quality of settable passwords" are different features. Which is the latter?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.