MD-102 Protect devices Practice Question
Which TWO conditions in a Conditional Access policy can be used to enforce device compliance for access to Microsoft 365 services?
⚠ Common exam trap
It's easy for candidates to confuse the 'Device state' condition with 'Sign-in risk' or 'Locations,' mistakenly thinking that location or risk level can enforce device compliance, when in fact only the 'Device state' condition directly checks compliance or domain join status.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Client apps (Browser, Mobile apps and desktop clients)
The 'Client apps' condition in a Conditional Access policy allows you to target specific client application types (e.g., browser, mobile apps, and desktop clients) to enforce device compliance. Option E is correct because the 'Device state' condition directly checks whether a device is marked as compliant in Microsoft Intune or is domain-joined (hybrid Azure AD join), which is the primary mechanism for enforcing device compliance for access to Microsoft 365 services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sign-in risk
Why it's wrong here
Sign-in risk is for risk-based conditional access, not device compliance.
- ✗
Locations (trusted IPs)
Why it's wrong here
Locations control access based on network location, not device compliance.
- ✗
Applications (e.g., Exchange Online)
Why it's wrong here
Applications are the target, not a condition.
- ✓
Client apps (Browser, Mobile apps and desktop clients)
Why this is correct
Client apps condition can require compliant device for specific app types.
- ✓
Device state (Compliant or Domain joined)
Why this is correct
Device state is the primary condition for compliance enforcement.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.