Configure Conditional Access to Require Compliant Devices for Email Access
Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online email. Which conditional access policy setting should you use?
Quick Answer
The answer is to configure the Conditional Access policy with the grant control "Require device to be marked as compliant." This setting ensures that only devices meeting your Intune compliance policies—such as requiring encryption, a minimum OS version, or a healthy threat level—can access Exchange Online email. Conditional Access evaluates the device’s compliance status in real time before granting a token, making it the precise control for this scenario. On the MD-102 exam, this question tests your ability to distinguish between compliance-based access and other controls like MFA or app protection policies; a common trap is confusing device enrollment with compliance, but enrollment alone does not enforce health checks. Remember the memory tip: "Compliance is the gatekeeper, enrollment is just the key."
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require device to be marked as compliant.
Conditional access in Microsoft Entra ID includes the grant control 'Require device to be marked as compliant,' which ensures that only devices meeting compliance policies can access corporate Exchange Online email. Option A is correct because this setting directly enforces compliance. Option B (Require multi-factor authentication) is separate—it adds identity verification but does not check device compliance. Option C (Require app protection policy) applies to mobile app management, not device-level access. Option D (Require device to be enrolled in Intune) ensures enrollment but does not guarantee compliance; a device could be non-compliant even if enrolled. Therefore, only the compliance requirement meets the goal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Require device to be marked as compliant.
Why this is correct
This ensures only compliant devices access corporate resources.
- ✗
Require multi-factor authentication.
Why it's wrong here
MFA does not enforce device compliance.
- ✗
Require app protection policy.
Why it's wrong here
App protection policies are for managed apps, not device compliance.
- ✗
Require device to be enrolled in Intune.
Why it's wrong here
Enrollment alone does not ensure compliance.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
App protection policy
An app protection policy is a set of rules that controls how data is handled and secured within mobile applications, ensuring corporate information stays safe even on personal devices.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. You configure a Conditional Access policy in Microsoft Entra ID targeting Exchange Online. What else must you configure in Intune to enforce compliance?
medium- ✓ A.Device compliance policies.
- B.No additional configuration is needed.
- C.Device configuration policies.
- D.App protection policies.
Why A: A is correct because Conditional Access policies in Microsoft Entra ID evaluate device compliance status, but they rely on Intune to report that status. Without a device compliance policy assigned to the device, Intune cannot mark the device as compliant, so the Conditional Access policy will block access or treat the device as non-compliant. You must create and assign a compliance policy in Intune that defines the required security baselines (e.g., encryption, OS version, jailbreak detection) for the device to be considered compliant.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.