You have a Microsoft Entra tenant named contoso.com and use Microsoft Intune. Each user in contoso.com has a Microsoft Entra ID P1 license and a…

Traffic to https://www.adatum.com:8433 matches the FQDN rule .adatum.com in WCFPolicy1. This policy is part of Profile1, which has a higher priority (300) than the baseline profile. Since Profile1 is linked to the Conditional Access policy CAPolicy1, this traffic is subject to its conditions. CAPolicy1 grants access only if the user's device is compliant, thus blocking access from noncompliant devices.

Traffic to https://www.fabrikam.com does not match the rule in Profile1. Therefore, Profile1 and the linked CAPolicy1 are not applied. The traffic is then evaluated by the next profile, the baseline profile. The baseline profile allows traffic unless it is explicitly categorized as malicious. Assuming fabrikam.com is not malicious, the traffic is allowed from all devices, regardless of their compliance state.

B. Traffic to https://www.adatum.com:8433 is allowed from compliant devices due to the Conditional Access policy, not blocked from all.

C. The linked Conditional Access policy explicitly blocks access to https://www.adatum.com:8433 from noncompliant devices.

D. The Conditional Access policy CAPolicy1 does not apply to traffic for https://www.fabrikam.com, so no device compliance check is enforced.

F. Traffic to https://www.fabrikam.com is not subject to CAPolicy1, so it is not blocked based on device compliance.

1. Microsoft Learn

Security profiles for Microsoft Entra Internet Access

"Profile processing" section. This document explains that profiles are processed in priority order. Traffic matching a higher-priority profile (like Profile1) is processed by it

and subsequent profiles are not evaluated for that traffic.

2. Microsoft Learn

Apply Conditional Access policies to Global Secure Access traffic

"Link a Conditional Access policy to a security profile" section. This source states

"When a user's traffic matches a security profile that is linked to a Conditional Access policy

the policy is enforced." This confirms that CAPolicy1 only applies to traffic matching Profile1 (i.e.

.adatum.com).

3. Microsoft Learn

Web content filtering in Microsoft Entra Internet Access

"Create web content filtering policies" section. This document details how to create filtering policies with rules based on FQDNs

confirming that .adatum.com is a valid rule type that matches www.adatum.com.

4. Microsoft Learn

Global Secure Access (preview) overview. The overview describes the baseline profile's function

which provides foundational security against malicious sites but does not block all traffic by default. Traffic not matching a specific security profile is evaluated against this baseline.