Hi @anh pham • Thank you for reaching out.
Self-service password reset is enabled for Administrators by default, even when you have not enabled SSPR in your tenant. Administrators can reset their password after performing two-gate authentication. The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number. A two-gate policy applies to users with below roles:
Application administrator
Application proxy service administrator
Authentication administrator
Azure AD Joined Device Local Administrator
Billing administrator
Compliance administrator
Device administrators
Directory synchronization accounts
Directory writers
Dynamics 365 administrator
Exchange administrator
Global administrator or company administrator
Helpdesk administrator
Intune administrator
Mailbox Administrator
Partner Tier1 Support
Partner Tier2 Support
Password administrator
Power BI service administrator
Privileged Authentication administrator
Privileged role administrator
SharePoint administrator
Security administrator
Service support administrator
Skype for Business administrator
User administrator
Read more: Administrator reset policy differences
-----------------------------------------------------------------------------------------------------------
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.