Device Compliance Enforcement for Exchange Online
Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access Exchange Online. The solution must require users to reauthenticate every 12 hours. What should you configure?
Quick Answer
The answer is to create a Conditional Access policy that grants access to Exchange Online only if the device is compliant, and set the session sign-in frequency to 12 hours. This is correct because Conditional Access acts as the policy engine that enforces device compliance as a grant control, directly integrating with Intune’s compliance policies to block non-compliant devices from Exchange Online. The session sign-in frequency control then forces reauthentication every 12 hours, satisfying the requirement without needing separate MFA prompts. On the AZ-500 exam, this scenario tests your understanding of how Conditional Access policies combine grant controls (device compliance) with session controls (sign-in frequency) to enforce device compliance enforcement for Exchange Online. A common trap is choosing an Intune compliance policy alone, which cannot enforce reauthentication intervals—that is a Conditional Access session feature. Memory tip: think “Grant + Session” as the two levers: Grant blocks the door, Session sets the timer.
⚠ Common exam trap
Test-takers frequently confuse device compliance policies with Conditional Access session controls, assuming sign-in frequency can be set directly in a compliance policy, when it is actually a separate Conditional Access setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy that grants access to Exchange Online only if the device is compliant, and set session sign-in frequency to 12 hours.
A Conditional Access policy can enforce device compliance as a grant control for Exchange Online, ensuring only compliant devices can access the service. Setting the session sign-in frequency to 12 hours forces users to reauthenticate at that interval, meeting the requirement without requiring MFA. This combines device compliance enforcement with session lifetime control in a single policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Conditional Access policy that requires MFA for Exchange Online and set sign-in frequency to 12 hours.
Why it's wrong here
Does not enforce device compliance.
- ✓
Create a Conditional Access policy that grants access to Exchange Online only if the device is compliant, and set session sign-in frequency to 12 hours.
Why this is correct
This enforces both device compliance and reauthentication frequency.
- ✗
Create an app protection policy for Exchange Online that requires device compliance and sets sign-in frequency.
Why it's wrong here
App protection policies apply to apps, not to Exchange Online directly.
- ✗
Configure a device compliance policy for all devices and enable 'Reauthenticate every 12 hours' in the compliance policy.
Why it's wrong here
Compliance policies do not have a reauthentication setting.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company uses Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with company policies can access corporate resources. You have configured compliance policies in Intune. What additional step is required to enforce access control based on device compliance?
medium- ✓ A.Create a Conditional Access policy that requires device to be marked as compliant
- B.Enable certificate-based authentication for all devices
- C.Deploy device configuration profiles to all devices
- D.Configure app protection policies in Microsoft Defender for Cloud Apps
Why A: A is correct because Conditional Access in Azure AD is the policy engine that enforces access control decisions based on signals like device compliance. Even after Intune compliance policies are configured, you must create a Conditional Access policy that requires the device to be marked as compliant. This policy blocks or grants access to corporate resources (e.g., Exchange Online, SharePoint) based on the compliance state reported by Intune to Azure AD.
Variation 2. Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access corporate email. You configure a Conditional Access policy targeting Exchange Online. Which grant control should you use?
medium- A.Require multifactor authentication
- ✓ B.Require device to be marked as compliant
- C.Block access
- D.Require hybrid Azure AD joined device
Why B: The scenario requires that only devices compliant with security policies can access corporate email. The 'Require device to be marked as compliant' grant control in Conditional Access checks the device compliance status reported by Microsoft Intune. If the device is not compliant, access to Exchange Online is blocked, ensuring policy enforcement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.