You have an Azure subscription that contains an Azure Directory (Azure AD) tenant named contoso.

No, No, Yes

In Microsoft Azure Active Directory (Azure AD), the Self-Service Password Reset (SSPR) feature allows users to securely reset their passwords using preconfigured authentication methods. The configuration in this scenario specifies:

Number of methods required to reset: 2

Available methods: Mobile phone and Security questions

Number of questions required to register: 3

Number of questions required to reset: 3

However, the key detail lies in the user types and roles involved:

SecAdmin1 (Security Administrator) and BillAdmin1 (Billing Administrator) are Azure AD administrators.

Azure AD documentation explicitly states that administrative accounts (users with Azure AD admin roles such as Global Administrator, Security Administrator, Billing Administrator, or other privileged roles) cannot use security questions as an authentication method for SSPR.

Admins are required to use stronger methods, such as phone, email, or app-based authentication (MFA-enabled).

Therefore, both SecAdmin1 and BillAdmin1 will not use security questions for password reset.

User1 (Reports reader) is a standard user, not an administrator.

Standard users can use security questions as one of their authentication methods.

Since security questions are enabled and three questions are required to reset the password, User1 must answer all three — including “What was the name of your first pet?”

Thus, according to Azure AD SSPR policy as covered in the Microsoft Learn AZ-104 study guide and official documentation under “Self-service password reset for administrators” and “Authentication methods in Azure Active Directory”, only non-administrative users can use security questions for SSPR.