MD-102 Manage and maintain devices Practice Question
You administer Microsoft Intune for a company with Windows 11 devices joined to Microsoft Entra ID. A security requirement states that if a device is found noncompliant, it must lose access to Microsoft 365 services within 15 minutes, and the device must be marked noncompliant automatically when a required antivirus signature is out of date. You need to implement this with the least administrative effort. What should you do?
⚠ Common exam trap
The trap here is treating a device configuration profile or a compliance policy alone as sufficient to revoke access, when Conditional Access is required to enforce compliance for cloud services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a compliance policy with an antivirus requirement, set the compliance status validity period to 15 minutes, and create a Conditional Access policy that requires compliant devices for Microsoft 365.
Compliance policies in Intune define the conditions a device must meet, and Conditional Access policies enforce those conditions for access to cloud apps. Setting the compliance status validity period to 15 minutes ensures Microsoft Entra ID quickly reflects a noncompliant state after antivirus signatures become stale. Together, these configurations automatically mark the device noncompliant and block Microsoft 365 access within the required time frame.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a device configuration profile that disables access to Microsoft 365 when antivirus signatures are stale, and assign it to all users.
Why it's wrong here
Device configuration profiles set settings on devices but do not evaluate compliance or block access to cloud services. They cannot mark a device noncompliant or enforce conditional access. Using a configuration profile alone would not meet the requirement to automatically mark devices noncompliant or revoke access to Microsoft 365 within the specified time frame.
- ✗
Create a compliance policy with an antivirus requirement and a device health attestation setting, then assign it to all users without a Conditional Access policy.
Why it's wrong here
A compliance policy alone can mark devices noncompliant, but without a Conditional Access policy requiring compliant devices, Microsoft Entra ID does not block access to Microsoft 365 services. Device health attestation reports health state but does not by itself revoke access. The requirement to lose access within 15 minutes therefore would not be met.
- ✓
Create a compliance policy with an antivirus requirement, set the compliance status validity period to 15 minutes, and create a Conditional Access policy that requires compliant devices for Microsoft 365.
Why this is correct
A compliance policy enforces the antivirus signature requirement and marks devices noncompliant when it fails. Setting the compliance status validity period to 15 minutes ensures Microsoft Entra ID reevaluates compliance quickly, and a Conditional Access policy requiring compliant devices blocks access to Microsoft 365 when the device is noncompliant. This combination meets the timing and automatic marking requirements with minimal overhead.
- ✗
Create a Conditional Access policy that requires multifactor authentication for all users and set a sign-in frequency of 15 minutes.
Why it's wrong here
Multifactor authentication and sign-in frequency control how often users must reauthenticate, but they do not evaluate device compliance or antivirus signature status. This approach would not mark a device noncompliant when signatures are stale and would not block access based on device health. It also adds user friction without addressing the compliance requirement.
Go deeper
Related to this question
Learn chapter
Implementing App Protection Policies (MAM)
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This MD-102 question is part of Courseiva's 556-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.