hardMultiple ChoiceObjective-mapped
MD-102 Practice Question: An endpoint administrator for a company that uses…
You are an endpoint administrator for a company that uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access Exchange Online. You have configured a Conditional Access policy that grants access to Exchange Online only if the device is marked as compliant. A user reports that they cannot access email from their iOS device, which is enrolled in Intune and shows as compliant. The user can access other Microsoft 365 services. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume a compliant device automatically satisfies all Conditional Access requirements, but they overlook the prerequisite that the specific workload (e.g., Exchange Online) must be enabled in Intune for the policy to apply to that service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Exchange Online workload is not enabled in Intune for mobile device management.
The most likely cause is that the Exchange Online workload is not enabled in Intune for mobile device management (MDM). Even though the device is enrolled and compliant, Intune must have the Exchange Online workload enabled to apply Conditional Access policies that govern email access. Without this, the Conditional Access policy cannot enforce compliance checks specifically for Exchange Online, resulting in access being blocked despite the device showing as compliant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user does not have an Exchange Online license assigned.
Why it's wrong here
The user can access other services, so licensing is likely fine.
- ✗
The Conditional Access policy is configured to block access from non-corporate networks.
Why it's wrong here
The policy grants access to compliant devices, so location is not blocking.
- ✗
The device compliance policy is not set to require a PIN or password.
Why it's wrong here
The device is compliant, so this is not the issue.
- ✓
The Exchange Online workload is not enabled in Intune for mobile device management.
Why this is correct
If the workload is not enabled, Intune cannot enforce compliance for Exchange Online access, causing the block.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
Key term
MDM
MDM stands for Mobile Device Management, a technology that allows IT administrators to securely manage, monitor, and enforce policies on mobile devices like smartphones and tablets from a central console.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.