AZ-500 Secure identity and access Practice Question
Your organization uses Microsoft Intune for mobile device management. You need to implement a conditional access policy that only allows access to corporate email from devices that are enrolled in Intune and compliant with security policies. However, the policy is not working for some users who report that they cannot access email even though their devices are compliant. You discover that the users have multiple devices and are signing in from a device that is not enrolled. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure users sign in only from compliant devices
Ensure users sign in only from compliant devices. In a Conditional Access scenario, the policy evaluates the specific device used for the sign-in, so if a user has multiple devices and authenticates from a non-enrolled or non-compliant one, access to corporate email will be blocked even if another of their devices is compliant; the fix is to make sure the sign-in originates from a compliant device. Option A is unnecessary and impractical because enrolling every device is not required by the policy, only the device being used for access must be enrolled and compliant. Option B would defeat the security requirement entirely by removing the control. Option C does not fit because app protection policies (MAM) protect app data on unmanaged devices but do not satisfy a Conditional Access requirement that the device itself be Intune-enrolled and compliant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enroll all devices in Intune
Why it's wrong here
Enrolling every device does not stop sign-in from an unenrolled one; the policy must require a compliant device as a grant control, so access is refused from non-enrolled hardware. Bulk enrolment is tempting when standardising corporate-owned fleets, but it cannot cover personally owned or unmanaged devices users sign in from.
- ✗
Remove the conditional access policy
Why it's wrong here
Removing the policy eliminates the Intune enrolment and compliance enforcement entirely, restoring access for unmanaged devices and defeating the security requirement. It is tempting as a quick fix for blocked users, and would be correct only if the organisation no longer needed device-based access control.
- ✗
Use app protection policies instead
Why it's wrong here
App protection policies safeguard corporate data within apps on unmanaged devices but do not require Intune enrolment or device compliance, so unenrolled devices still reach email. It is tempting because they cover BYOD scenarios, and would be correct where device enrolment is not mandated.
- ✓
Ensure users sign in only from compliant devices
Why this is correct
Conditional access evaluates the device used at sign-in, so a compliant device does not help when the user authenticates from an unenrolled one. Requiring sign-in only from compliant devices blocks that access, satisfying the policy's device-compliance constraint.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.