Require Compliant Device with Conditional Access
Your organization uses Microsoft Entra ID for identity management. You need to ensure that users accessing sensitive data from unmanaged devices are required to use a compliant device. What should you configure?
Quick Answer
The correct answer is to configure a Conditional Access policy that requires the device be marked as compliant. This works because Conditional Access evaluates signals like device state against your access controls, and the “Require compliant device” grant directly enforces that only devices enrolled in Microsoft Entra ID and meeting your compliance policies (e.g., via Intune) can access sensitive data. On the AZ-500 exam, this scenario tests your understanding of how Conditional Access policies integrate with device management to secure unmanaged devices—a common trap is confusing device registration (which just identifies a device) with compliance (which checks health and configuration). Remember the key distinction: registration proves identity, compliance proves health. A quick memory tip is “Compliance is the gatekeeper for sensitive data; registration is just the ID card.”
⚠ Common exam trap
A common mix-up: candidates confuse requiring MFA (Option D) with requiring device compliance, but MFA only verifies the user, not the device's security posture, which is the core requirement in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Conditional Access policy that requires that the device be marked as compliant
A Conditional Access policy that requires the device to be marked as compliant ensures that only devices meeting your organization's compliance standards (e.g., antivirus enabled, encryption active) can access sensitive data. This policy evaluates device compliance status reported by Microsoft Intune or another MDM provider, and blocks or grants access based on that status. It directly addresses the requirement to enforce compliant device access from unmanaged devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a device registration policy
Why it's wrong here
Device registration does not enforce compliance.
- ✓
Configure a Conditional Access policy that requires that the device be marked as compliant
Why this is correct
This enforces device compliance for access to sensitive data.
- ✗
Configure an Identity Protection policy for user risk
Why it's wrong here
Identity Protection focuses on risk, not device state.
- ✗
Configure a Conditional Access policy that requires multi-factor authentication
Why it's wrong here
MFA does not enforce device compliance.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Entra ID for identity management. You need to prevent users from using their work accounts to access corporate resources from untrusted locations unless they have registered their devices. Which conditional access policy setting should you configure?
easy- A.Grant access, require approved client app
- ✓ B.Grant access, require device to be marked as compliant
- C.Block access
- D.Grant access, require multi-factor authentication
Why B: The 'Grant access, require device to be marked as compliant' condition ensures that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus running, OS patch level) can access corporate resources. When combined with a location condition (e.g., 'All trusted locations' or 'All locations' with an exclusion for trusted IPs), this setting effectively blocks access from untrusted locations unless the device is compliant, which implies it has been registered and managed in Microsoft Entra ID.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.