Basically, some administrative roles, by design can only use strong, two-gate password reset policy, regardles of SSPR settings. User Administrator and Password Administrator will be always forced to use two methods and cannot use security questions. Securiry Reader and User will use whatever is set under SSPR, so security questions in this case. https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#administrator-reset-policy-differences