easyMultiple ChoiceObjective-mapped
Conditional Access with Device Compliance for Exchange Online
A company is planning to implement Microsoft Intune for mobile device management. They want to ensure that only compliant devices can access Exchange Online. Which technology should they use?
Quick Answer
The answer is Conditional Access policies with device compliance. This is the correct technology because it bridges Microsoft Intune’s compliance enforcement with Azure AD’s identity-driven access control, allowing you to block or restrict Exchange Online access for any device flagged as non-compliant by Intune. On the MD-102 exam, this scenario tests your understanding of how device management and identity protection converge—a common trap is confusing device compliance policies alone (which only report status) with the Conditional Access policy that actually enforces the block. Remember the pairing: Intune marks the device, Conditional Access enforces the gate. A useful memory tip is “Compliance flags the car, Conditional Access lifts the gate”—without the gate, the flag does nothing.
⚠ Common exam trap
Watch out — candidates often confuse Intune compliance policies alone with Conditional Access, thinking that marking a device non-compliant automatically blocks access, when in fact a Conditional Access policy is required to enforce the block.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policies with device compliance
Conditional Access policies with device compliance (Option D) is the correct technology because it integrates Intune compliance policies with Azure AD Conditional Access to enforce access controls on Exchange Online. When a device is marked non-compliant by Intune, Conditional Access blocks or restricts access to Exchange Online, ensuring only compliant devices can connect. This is the standard Microsoft approach for combining device management with identity-driven access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mobile Application Management (MAM) policies
Why it's wrong here
MAM protects app data, not device compliance.
- ✗
Intune compliance policies without Conditional Access
Why it's wrong here
Compliance policies alone do not block access; they need CA.
- ✗
Azure AD join with automatic enrollment
Why it's wrong here
Joining alone does not enforce compliance.
- ✓
Conditional Access policies with device compliance
Why this is correct
Conditional Access can block non-compliant devices.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Device compliance
Device compliance is the process of ensuring that a device meets an organization's security and configuration policies before it can access network resources.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This MD-102 question is part of Courseiva's 942-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Microsoft Intune to manage Windows 10 devices. They want to ensure that devices have BitLocker enabled and are compliant before accessing corporate resources. Which TWO actions should the administrator take? (Choose two.)
medium- A.Assign the device compliance policy to all users.
- ✓ B.Create a device compliance policy that requires BitLocker.
- C.Enable Windows Hello for Business.
- D.Create a device configuration profile to enable BitLocker.
- ✓ E.Create a Conditional Access policy that grants access only to compliant devices.
Why B: A device compliance policy in Microsoft Intune can include the setting to require BitLocker on Windows 10 devices. This policy evaluates the device's BitLocker status and marks it as noncompliant if BitLocker is not enabled, which is a prerequisite for Conditional Access to block access to corporate resources.
Variation 2. Refer to the exhibit. A Windows 10 device is showing as non-compliant. The compliance policy 'Require BitLocker' is assigned to all devices. The device does not have BitLocker enabled. However, the user is able to access corporate email on the device. What is the most likely reason for this?
medium- A.The compliance policy has a grace period of 7 days for BitLocker.
- B.The compliance policy is not assigned to the device.
- C.The device is configured as a kiosk device, which exempts it from compliance.
- ✓ D.There is no Conditional Access policy that requires compliant device for access to corporate email.
Why D: D is correct because compliance policies alone do not enforce access restrictions; they only report device compliance status. To block access to corporate email, a Conditional Access policy must be configured to require a compliant device. Without such a policy, the device can still access email even if it is non-compliant.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.