A company uses Microsoft Entra ID. They want to block all access to corporate applications from devices that are not managed by their organization. They require that only devices enrolled in Microsoft Intune and compliant with company policies can access company resources. Which Microsoft Entra ID feature should they use?

Identity Protection with user risk policy

Incorrect. Identity Protection focuses on sign-in risk behavior, not device compliance.

Privileged Identity Management (PIM)

Incorrect. PIM is for just-in-time privileged role management, not device-based access control.

Microsoft Entra ID Join process

Incorrect. Microsoft Entra ID Join registers devices but does not enforce compliance policies; Conditional Access is needed for enforcement.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Conditional Access policy requiring device compliance — Microsoft Entra ID Conditional Access allows administrators to enforce access controls based on conditions such as device compliance. By creating a policy that requires device to be marked as compliant, only managed and compliant devices are granted access. Identity Protection focuses on risk detection. Privileged Identity Management manages privileged roles. Microsoft Entra ID Join is a device identity method, not a policy itself.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.