Entra External ID forgot password page shows contradictory password complexity requirements

We are seeing contradictory password complexity guidance on the Microsoft-hosted Entra External ID forgot password / reset password page.

On the same reset password screen, the static requirement text says:

“Use at least 8 characters. The password is case-sensitive and must include 3 of the following characters: an uppercase letter, a lowercase letter, a number, or a symbol.”

However, after entering a password with fewer than 8 characters and clicking Reset password, the inline validation error says:

“Passwords must include at least 8 characters and include at least two of the following types: uppercase and lowercase letters, numbers, and symbols.”

These two messages contradict each other: one says 3 of 4 character categories are required, while the other says 2 of 4.