Quick Answer

The answer is device compliance status, user sign-in risk level, and application sensitivity labels. Device compliance status is a valid condition because Conditional Access evaluates whether a device is marked as compliant by Microsoft Intune, enforcing access only from managed and healthy devices. User sign-in risk level leverages Azure AD Identity Protection to detect compromised credentials or anomalous sign-in behavior, blocking high-risk sessions automatically. Application sensitivity labels integrate with Microsoft Information Protection to restrict access or actions like download or edit based on the label applied to a document or email. On the AZ-500 exam, this tests your understanding of how Conditional Access conditions extend beyond simple location or group membership into device management and data protection. A common trap is confusing location or client app conditions with the more advanced compliance and risk-based controls. Remember the mnemonic “D.R.S.”—Device, Risk, Sensitivity—to recall the three non-standard conditions that enforce granular access.