MD-102 practice question 20 of 35

You have a Microsoft 365 E5 subscription. All devices are enrolled in Microsoft Intune. You create a Conditional Access policy named Policy1 that…

Choose your answer, then check it against the explanation.

Domain Manage, maintain, and protect devices

You have a Microsoft 365 E5 subscription. All devices are enrolled in Microsoft Intune. You create a Conditional Access policy named Policy1 that requires multifactor authentication (MFA). You need to ensure that Policy1 only applies to devices marked as noncompliant. Which settings of Policy1 should you configure?

Answer options

Correct Answer:

Explanation

The "Filter for devices" setting, located under the Conditions section of a Conditional Access policy, allows for granular targeting based on specific device attributes registered in Azure AD. To ensure a policy applies only to noncompliant devices, you can configure a filter rule using the isCompliant attribute. The rule syntax device.isCompliant -eq false will precisely scope the policy to trigger only for devices that Intune has marked as noncompliant, thereby enforcing the MFA requirement exclusively on them.

Why Incorrect

A. Device platforms under Conditions: This setting targets devices based on their operating system (e.g., Windows, iOS, Android), not their compliance status.

C. Target resources: This setting defines which cloud applications or user actions the policy protects, not which devices the policy applies to.

D. Grant: The Grant control enforces requirements, such as blocking access or requiring a compliant device. It is the action taken after conditions are met, not the condition itself for targeting.

E. Session: Session controls apply after a user has been granted access and are used to manage the user's session, such as setting sign-in frequency.

References

1. Microsoft Learn. (2023). Filter for devices as a condition in Conditional Access policy. "Supported attributes" section. The document explicitly lists isCompliant as a supported attribute for filtering. The example section shows how to build rule syntax

which can be adapted to (device.isCompliant -eq false).

2. Microsoft Learn. (2023). Conditional Access: Conditions. "Filter for devices (preview)" section. This document describes the purpose of the filter for devices condition: "This condition allows organizations to include or exclude devices based on a filter using a rule expression on device properties."

3. Microsoft Learn. (2023). Conditional Access: Grant. This document details the Grant access controls

which include "Require device to be marked as compliant." This is an enforcement action

distinct from the policy's targeting condition

which is what the question asks to configure.

Question 20 of 35

Keep practicing

Take the free MD-102 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test