Explanation:
Users: Admin1 and Admin2 only
Group: Group1, or Group3
In Microsoft Entra ID (Azure Active Directory), Self-Service Password Reset (SSPR) is configured at the tenant level and can be scoped either to all users or to selected groups. Both who can configure SSPR and which groups are eligible are strictly defined by Microsoft Entra role permissions and group support rules.
Who can configure SSPR
Microsoft Entra documentation clearly states that only the following administrative roles are authorized to configure and manage SSPR settings:
Global Administrator
Authentication Policy Administrator
In this scenario:
Admin1 is a Global Administrator # # Allowed
Admin2 is an Authentication Policy Administrator # # Allowed
Admin3 holds Authentication Administrator and Security Administrator roles # # These roles cannot configure SSPR policies Microsoft explicitly distinguishes authentication method management from SSPR policy configuration, which is why Authentication Administrators and Security Administrators do not have permission to configure SSPR.
# Correct Users selection: Admin1 and Admin2 only
Which groups can have SSPR enabled
When enabling SSPR for Selected users, Microsoft Entra supports only assigned membership security-based groups.
According to Microsoft documentation:
Security groups (Assigned) # # Supported
Mail-enabled security groups (Assigned) # # Supported
Microsoft 365 groups # # Not supported
Dynamic groups # # Not supported
Applying this to the provided groups:
Group1 - Security, Assigned # # Eligible
Group2 - Microsoft 365, Dynamic # # Not eligible
Group3 - Mail-enabled security, Assigned # # Eligible
# Correct Group selection: Group1 or Group3 only
Final Answer Summary
Section
Correct Selection
Users
Admin1 and Admin2 only
Group
Group1 or Group3 only
Microsoft Entra Administrator documentation extract:
"Only Global Administrators and Authentication Policy Administrators can configure self-service password reset settings."
"SSPR can be enabled for security groups and mail-enabled security groups with assigned membership.
Dynamic groups and Microsoft 365 groups are not supported."
# Final Verified Answer:
Users: Admin1 and Admin2 only
Group: Group1 or Group3 only