MD-102 Protect devices Practice Question
Which THREE conditions can be used in a Conditional Access policy to require a compliant device?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Client apps
Options B, C, and D are correct. Option B: Client apps condition allows targeting specific applications or user actions. Option C: Locations condition allows requiring compliance based on IP ranges or countries. Option D: Device platform condition allows targeting specific operating systems. Option A is incorrect because the Device state condition includes options like 'Device hybrid Azure AD joined' and 'Device marked as compliant', but it filters based on current state rather than requiring compliance. To require a compliant device, you use the grant control, not the Device state condition. Option E is incorrect because sign-in risk is a condition but is not used to require a compliant device; it's used for risk-based policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Device state
Why it's wrong here
Device state is for hybrid Azure AD join, not compliance.
- ✓
Client apps
Why this is correct
Can require compliance for browser, mobile apps, desktop clients.
- ✓
Locations
Why this is correct
Can require compliance only from trusted or untrusted locations.
- ✓
Device platform
Why this is correct
Can target iOS, Android, Windows, macOS.
- ✗
Sign-in risk
Why it's wrong here
Risk is a condition but not specifically for device compliance.
Go deeper
Related to this question
Learn chapter
Configuring Compliance Policies
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO conditions in a Conditional Access policy can be used to enforce device compliance for access to Microsoft 365 services?
hard- A.Sign-in risk
- B.Locations (trusted IPs)
- C.Applications (e.g., Exchange Online)
- ✓ D.Client apps (Browser, Mobile apps and desktop clients)
- ✓ E.Device state (Compliant or Domain joined)
Why D: The 'Client apps' condition in a Conditional Access policy allows you to target specific client application types (e.g., browser, mobile apps, and desktop clients) to enforce device compliance. Option E is correct because the 'Device state' condition directly checks whether a device is marked as compliant in Microsoft Intune or is domain-joined (hybrid Azure AD join), which is the primary mechanism for enforcing device compliance for access to Microsoft 365 services.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.