AZ-204 Implement Azure security Practice Question
Your company uses Microsoft Entra ID for identity management. You need to ensure that users accessing a line-of-business application from unmanaged devices must complete a multi-factor authentication (MFA) challenge. What should you configure?
⚠ Common exam trap
Test-takers frequently confuse device compliance policies (Intune) with Conditional Access policies, or they assume a blanket MFA policy for all users is sufficient, missing the specific device state condition that targets unmanaged devices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy that requires MFA for users accessing the application, with a condition for 'Device state' set to 'Unmanaged'.
A Conditional Access policy in Microsoft Entra ID allows you to target specific applications and require MFA based on the device state condition. By setting the device state condition to 'Unmanaged', the policy applies only to devices that are not managed by your organization (e.g., not joined or compliant with Intune), ensuring that users on unmanaged devices must complete an MFA challenge before accessing the line-of-business application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Conditional Access policy that requires MFA for users accessing the application, with a condition for 'Device state' set to 'Unmanaged'.
Why this is correct
This is the correct approach because Microsoft Entra Conditional Access policies are specifically designed to enforce access controls based on various conditions, including the application being accessed and the state of the device. By configuring a policy to target the specific application and setting the 'Device state' condition to 'Unmanaged' (which typically means devices that are not Azure AD joined, Hybrid Azure AD joined, or Azure AD registered), you can precisely require multi-factor authentication (MFA) only when users attempt to access that application from a device not managed by the organization.
- ✗
Configure a device compliance policy in Microsoft Intune.
Why it's wrong here
Configuring a device compliance policy in Microsoft Intune defines the security standards a device must meet (e.g., OS version, encryption) to be considered compliant. While these policies are essential for device management and can be used as a condition within Conditional Access, they do not directly enforce multi-factor authentication during a user's sign-in attempt. A compliance policy alone reports a device's status but does not dictate authentication methods for application access.
- ✗
Create a Conditional Access policy that requires MFA for all users.
Why it's wrong here
Creating a Conditional Access policy that requires MFA for all users would apply this control indiscriminately to every sign-in attempt, regardless of the device's management status. This approach fails to meet the specific requirement of targeting *only* unmanaged devices. Such a broad policy would enforce MFA even when users access the application from corporate-managed, compliant devices, which is an unnecessary over-application of the security control in this scenario.
- ✗
Enable risk-based Conditional Access in Microsoft Entra ID Protection.
Why it's wrong here
Enabling risk-based Conditional Access in Microsoft Entra ID Protection focuses on evaluating the real-time risk associated with a sign-in attempt or a user's overall risk profile (e.g., impossible travel, unfamiliar sign-in properties, leaked credentials). While powerful for adaptive security, these policies primarily respond to detected threats or anomalies, not the inherent managed or unmanaged state of a device. They do not directly provide a condition to specifically target devices based on their enrollment or management status for MFA enforcement.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.