Microsoft 365 Administrator Expert MS-102 Practice Question

When a hybrid user is forced to change their password as part of the User risk policy, Microsoft Entra ID Protection invokes the self-service password reset (SSPR) flow. In a hybrid environment, the new password must be written back to the on-premises Active Directory; otherwise the cloud and on-premises credentials will diverge, blocking subsequent sign-ins. Password writeback is enabled through Azure AD Connect and is a documented prerequisite for risk-based password resets. The other options do not satisfy this requirement: switching to pass-through authentication changes the sign-in method but not writeback, Smart lockout only protects against brute-force attacks, and installing Password Protection on domain controllers adds banned-password enforcement but does not replicate password changes from the cloud.