An administrator is enabling self-service password reset and password protection in Microsoft Entra ID and wants to confirm what each capability actually does. Which THREE statements about these capabilities are correct? Select THREE.
- ASelf-service password reset lets users change or reset their own passwords without help desk contact Correct
- BPassword protection blocks weak passwords by checking them against banned password lists Correct
- CSelf-service password reset requires users to register approved authentication methods beforehand Correct
- DPassword protection applies only to cloud accounts and cannot be extended to on-premises Active Directory
- EPassword protection responds to a weak password by automatically enrolling the user in multifactor authentication
Why A is correct: Self-service password reset allows users to reset or unlock their accounts themselves after verifying identity, which is its purpose.
Why B is correct: Password protection evaluates new passwords against the global and custom banned lists to stop weak choices, which is correct.
Why C is correct: Users must register the required number of authentication methods before they can verify identity and use self-service reset.
Why D is wrong: Tempting because the feature lives in Microsoft Entra, but password protection can be extended to on-premises Active Directory using domain controller agents, so the cloud-only claim is wrong.
Why E is wrong: Tempting because both harden sign-in, but password protection only screens passwords against banned lists; enrolling a user in multifactor authentication is a separate capability it never performs.