What's changed: Created MS-102 Chapter 2 (domain: Microsoft Entra identity and access): identity synchronization (IdFix pre-remediation, Microsoft Entra Connect Sync vs Cloud Sync, Connect Health monitoring, troubleshooting), authentication (authentication methods, SSPR, Password Protection global/custom banned lists, password writeback), and secure access (Identity Protection risk detection and risk policies, Conditional Access signals and grant/block, enforcing MFA via Conditional Access, require compliant device).
2.2Authentication
Understand managing authentication methods, self-service password reset (SSPR), Microsoft Entra Password Protection to block weak/banned passwords, and investigating authentication issues.
Sign-in security improves by combining authentication methods, user self-recovery of passwords, and eliminating weak passwords—each with a distinct role.
2.2.1Authentication methods and SSPR
In authentication methods, enable/control available factors such as Microsoft Authenticator, FIDO2 security keys, phone, and OATH tokens. Self-service password reset (SSPR) lets users reset their own password using registered methods, reducing help-desk load (password writeback is needed to reflect on-prem).
2.2.2Password Protection
Microsoft Entra Password Protection blocks weak/guessable/banned passwords. Beyond Microsoft’s global banned password list, you can set an org-specific custom banned password list (company/product names) and extend it to on-prem AD. Whereas SSPR is "a way for users to reset," Password Protection enforces the quality of passwords that can be set.
Cues: "enable available factors (Authenticator/FIDO2/phone)" = authentication methods. "users reset their own password" = SSPR. "block weak/banned passwords, custom banned list" = Password Protection. SSPR reflecting on-prem = password writeback.
Watch the mix-ups: (1) SSPR (a reset mechanism for users) vs Password Protection (enforcing password quality). (2) Authentication methods (enabling factors) underpin SSPR/MFA but are a separate setting. (3) Custom banned password list = Password Protection. (4) Reflecting SSPR on-prem needs password writeback.
2.2.3Section summary
- Authentication methods enable/control factors like Authenticator/FIDO2/phone
- SSPR lets users reset their own password (on-prem needs writeback)
- Password Protection blocks weak/banned passwords (global + custom banned lists)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To reduce help-desk calls, you want users to securely reset their own password using registered methods. Best?
Q2. You want to block users from setting guessable passwords containing company/product names. Best?
Q3. You want to enable Microsoft Authenticator and FIDO2 security keys as factors users can use for MFA/SSPR. Where do you configure this?
Q4. After SSPR resets the cloud password, the on-prem AD password isn’t updated. What configuration is needed?
Q5. "Self-recovery when users forget passwords" and "enforcing the quality of settable passwords" are different features. Which is the latter?