According to the official Microsoft Identity and Access Administrator (SC-300) Study Guide and the Azure Active Directory documentation under "Enable and configure self-service password reset (SSPR)", when self- service password reset is enabled, the available authentication methods depend on the user's role within Azure AD. Specifically, administrative roles require stronger authentication methods than regular users.
The Microsoft documentation states:
"Security questions are available only to users who are not administrators. Any user assigned an administrative role must use secure authentication methods such as email, mobile app, or phone verification." This restriction ensures that privileged accounts (e.g., User Administrator, Password Administrator, Global Administrator, Security Administrator, etc.) use stronger, phishing-resistant recovery options.
In the provided table:
* User1 (User Administrator) and User2 (Password Administrator) are administrators - they cannot use security questions for SSPR.
* User3 (Security Reader) and User4 (User) are non-administrative roles, therefore, they can use security questions when resetting their passwords.
Hence, only User3 and User4 will be required to answer security questions during password reset.