Self-service password reset (SSPR) is enabled for a group, but users report the option isn't available. The users are synced from on-premises AD and password writeback isn't configured. What's missing?
A.Users need Entra ID P2 licenses
SSPR needs P1 for synced users — not P2.
B.Password writeback must be enabled in Entra Connect for synced users
Writeback is the required hybrid piece. Correct.
C.Conditional Access is blocking the reset flow
Conditional Access doesn't gate the SSPR flow itself.
D.Users must register security info via My Apps portal instead
Security info registration happens in My Sign-Ins — but registration isn't the issue described.
Why this answer
For cloud-only users SSPR works out of the box. For HYBRID (synced) users, password writeback must be enabled in Entra Connect — otherwise the cloud-side reset can't push the new password back to on-premises AD. This is the classic SSPR gotcha.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Identity & Governance practice session.
Practice Identity & Governance