SSPR

In the Ultra Transcenders books

AZ-104SC-900AB-900SC-300MD-102

Each book explains SSPR in context, with comparison tables and the common traps.

Terms in this definition

• APPLY

  Evaluates a table-valued expression for every row on its left, inside FROM. Think of OUTER APPLY as a left outer join and CROSS APPLY as an inner join.

• ALL

  A DAX function that ignores any filters and gives back every row of a table or every value of the named columns. Used within CALCULATE, it works as a modifier that clears filters, although REMOVEFILTERS states that intent more clearly where it is available.

Related terms

• Authentication Administrator

  Microsoft Entra role for managing authentication methods on individual user accounts. Tenant-wide SSPR and the authentication methods policy lie outside its reach.

• Authentication Policy Administrator

  Least-privileged Microsoft Entra role for tenant-level SSPR settings and the authentication methods policy, neither of which Authentication Administrator can change.

• Legacy MFA and SSPR policies

  Older, all-users-or-nobody controls that once governed which multifactor authentication and self-service password reset methods were allowed. From 30 September 2025 methods can no longer be configured there, as that role has passed to the Authentication methods policy.

• Register security information

  Lets a Conditional Access policy kick in at the moment someone enrols methods for MFA or SSPR, for instance demanding a Temporary Access Pass or a trusted location. Enrolment of Windows Hello for Business and macOS Platform SSO has been covered too since July 2026.

• Reports Reader

  Entra role able to read audit and sign-in reports. Because the administrator SSPR policy does not cover it, those holding it are subject to the ordinary user SSPR policy.

• Security Administrator

  Role in Microsoft Entra ID that looks after security settings and security reports. Holders cannot alter the self-service password reset policy or decide who may invite guests.

• Security questions

  Authentication method usable only for SSPR; answering several questions still counts as a single method. Administrators are barred from it, and it is due to be retired in March 2027.

• Two-gate policy

  The built-in self-service password reset policy for anyone holding a Microsoft Entra admin role, which cannot be changed. It requires two verification methods and does not permit security questions.