Set Conditional Access to Require Compliant Device for Access
You are configuring conditional access policies in Microsoft Entra ID to require compliant devices for access to Microsoft 365 services. Some users report that they cannot access Outlook Web App (OWA) even though their device is marked as compliant in Intune. What should you verify?
Quick Answer
The answer is to verify that the conditional access policy has the grant control set to 'Require device to be marked as compliant'. This is correct because a device can be compliant in Intune but still be blocked by a conditional access policy if the policy’s grant control is misconfigured; without explicitly requiring compliant device status, the policy might enforce other conditions like multi-factor authentication or simply deny access, overriding the device’s compliance state. On the MD-102 exam, this scenario tests your understanding of how conditional access grant controls interact with Intune compliance policies—a common trap is assuming Intune compliance alone grants access, when in fact the Entra ID policy must explicitly demand it. A useful memory tip is “Compliance in Intune is just a label; the grant control is the gatekeeper.”
⚠ Common exam trap
Many candidates assume device compliance alone is sufficient for access, but they overlook that the conditional access policy must explicitly include the 'Require device to be marked as compliant' grant control to enforce compliance-based access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The conditional access policy has the grant control set to 'Require device to be marked as compliant'.
The most likely cause of users being unable to access OWA despite device compliance is that the conditional access policy's grant control is not set to 'Require device to be marked as compliant'. Without this grant, the policy may apply other controls (e.g., MFA) or block access entirely, even if the device is compliant in Intune. This setting explicitly enforces that only compliant devices can access the targeted cloud apps, such as Office 365 Exchange Online.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The conditional access policy has the grant control set to 'Require device to be marked as compliant'.
Why this is correct
Without this grant, the policy might only apply other controls like MFA, not compliance.
- ✗
All users have the required Microsoft 365 license.
Why it's wrong here
Licensing is usually verified beforehand; this error would prevent access altogether.
- ✗
The conditional access policy includes all cloud apps.
Why it's wrong here
If it includes all, OWA is covered; the issue is likely the grant control.
- ✗
The device platform condition is set to iOS and Android only.
Why it's wrong here
If the device is compliant, the platform is likely correct; the grant control is the issue.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are configuring Conditional Access for device compliance. You have an Intune compliance policy that requires a minimum OS version. You create a Conditional Access policy that grants access only when devices are marked as compliant. However, some users can still access corporate email from non-compliant devices. What is the most likely reason?
hard- A.The Conditional Access policy is set to 'Block' instead of 'Grant'.
- B.The Conditional Access policy applies only to users in a specific group.
- C.The compliance policy is not assigned to the users' devices.
- ✓ D.The Conditional Access policy does not include the email application as a target.
Why D: A Conditional Access policy must include at least one cloud app as a target. If the corporate email application (e.g., Exchange Online) is not included in the policy, the policy will not apply to access attempts for that app, allowing non-compliant devices to connect. Option A is incorrect because a 'Block' policy would block access, not allow it. Option B is incorrect because the policy's user scope does not affect whether the app is targeted. Option C is incorrect because while compliance policy assignment is important, the most direct reason is the missing app target.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.