Require Compliant Device with Conditional Access
Your organization uses Microsoft Entra ID for identity management. You need to ensure that users accessing sensitive data from unmanaged devices are required to use a compliant device. What should you configure?
Quick Answer
The correct answer is to configure a Conditional Access policy that requires the device be marked as compliant. This works because Conditional Access evaluates signals like device state against your access controls, and the “Require compliant device” grant directly enforces that only devices enrolled in Microsoft Entra ID and meeting your compliance policies (e.g., via Intune) can access sensitive data. On the AZ-500 exam, this scenario tests your understanding of how Conditional Access policies integrate with device management to secure unmanaged devices—a common trap is confusing device registration (which just identifies a device) with compliance (which checks health and configuration). Remember the key distinction: registration proves identity, compliance proves health. A quick memory tip is “Compliance is the gatekeeper for sensitive data; registration is just the ID card.”
⚠ Common exam trap
A common mix-up: candidates confuse requiring MFA (Option D) with requiring device compliance, but MFA only verifies the user, not the device's security posture, which is the core requirement in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Conditional Access policy that requires that the device be marked as compliant
A Conditional Access policy that requires the device to be marked as compliant ensures that only devices meeting your organization's compliance standards (e.g., antivirus enabled, encryption active) can access sensitive data. This policy evaluates device compliance status reported by Microsoft Intune or another MDM provider, and blocks or grants access based on that status. It directly addresses the requirement to enforce compliant device access from unmanaged devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a device registration policy
Why it's wrong here
A device registration policy governs how devices join Microsoft Entra ID, not the access condition itself. Requiring a compliant device needs a Conditional Access policy granting access only when the device meets compliance. Registration is tempting because unmanaged devices must first be registered, but registration alone enforces no compliance gate.
- ✓
Configure a Conditional Access policy that requires that the device be marked as compliant
Why this is correct
A Conditional Access policy evaluates device state at sign-in, and requiring the device be marked compliant enforces that only Intune-managed, policy-compliant devices reach the sensitive data. This directly satisfies the stem's constraint of blocking access from unmanaged devices.
- ✗
Configure an Identity Protection policy for user risk
Why it's wrong here
Identity Protection user-risk policies respond to signals such as leaked credentials or anomalous sign-in behaviour, and cannot evaluate device compliance state. It is tempting because it is a Conditional Access-adjacent identity control, but enforcing a compliant device requires device conditions in a Conditional Access policy, not risk detection.
- ✗
Configure a Conditional Access policy that requires multi-factor authentication
Why it's wrong here
Requiring multi-factor authentication verifies the user's identity but says nothing about the device's compliance state, so an unmanaged device still gains access. It is tempting because MFA is a common Conditional Access control, yet the scenario demands a device compliance grant, which only a Conditional Access policy with device conditions enforces.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Entra ID for identity management. You need to prevent users from using their work accounts to access corporate resources from untrusted locations unless they have registered their devices. Which conditional access policy setting should you configure?
easy- A.Grant access, require approved client app
- ✓ B.Grant access, require device to be marked as compliant
- C.Block access
- D.Grant access, require multi-factor authentication
Why B: The 'Grant access, require device to be marked as compliant' condition ensures that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus running, OS patch level) can access corporate resources. When combined with a location condition (e.g., 'All trusted locations' or 'All locations' with an exclusion for trusted IPs), this setting effectively blocks access from untrusted locations unless the device is compliant, which implies it has been registered and managed in Microsoft Entra ID.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.