The built-in self-service password reset policy for anyone holding a Microsoft Entra admin role, which cannot be changed. It requires two verification methods and does not permit security questions.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Two-gate policy in context, with comparison tables and the common traps.
Terms in this definition
- SSPR
Allows users to unlock or reset their own passwords with methods they have registered. It can apply to All users, None, or Selected (a single group, with nesting supported).
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.
- Microsoft Entra admin
Set on an Azure SQL managed instance or logical server, this is the single Entra principal (a user, group, managed identity or service principal) able to log in to all its databases and to add further Entra users.
- Role
How an actor normally or expectedly behaves, or the part a person takes in a process. A single actor may hold more than one role.
- Security questions
Authentication method usable only for SSPR; answering several questions still counts as a single method. Administrators are barred from it, and it is due to be retired in March 2027.