Statement

Answer

User1 must correctly answer “In which city was your first job?” to reset their password.

No

User2 must correctly answer “What is your favorite food?” to reset their password.

No

User3 must correctly answer “What was the name of your first pet?” to reset their password.

Yes

Microsoft Entra SSPR applies a different reset policy to accounts assigned Azure/Microsoft Entra administrator roles. Microsoft states that administrator accounts use a strong default two-gate password reset policy, that this policy cannot be changed, and that the policy prohibits security questions. Microsoft’s affected administrator-role list explicitly includes Security Administrator and Directory Writers, so User1 and User2 cannot reset their passwords by answering security questions. Therefore, the statements for User1 and User2 are No, even though security questions are enabled for regular users.

User3 has the Reports Reader role, which is not listed in Microsoft’s affected administrator-role list for the two-gate administrator SSPR policy. User3 therefore follows the configured user SSPR policy. The tenant requires one authentication method, the only available method is security questions, and the configuration requires three questions to reset. Since exactly three security questions are enabled, User3 must answer all three enabled questions, including “What was the name of your first pet?” Microsoft confirms that SSPR checks whether the user has the required authentication methods according to the administrator-configured policy before allowing password reset.