easyMultiple SelectObjective-mapped
MD-102 Practice Question: Configuring Microsoft Entra Conditional Access…
You are configuring Microsoft Entra Conditional Access for a company that requires all employees to use multi-factor authentication (MFA) when accessing the Azure portal. The company also wants to block access from devices that are not compliant. You create a Conditional Access policy. Which two assignments must you configure to meet these requirements? (Choose two.)
⚠ Common exam trap
Many exam-takers confuse 'Block access for non-compliant devices' (which does not exist as a Grant control) with the correct 'Require device to be marked as compliant', or they mistakenly think a hybrid join requirement is needed for MFA enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant access, require multi-factor authentication
The requirement to enforce multi-factor authentication (MFA) for Azure portal access is met by configuring the 'Grant' control to 'Require multi-factor authentication'. Option D is correct because blocking access from non-compliant devices is achieved by selecting 'Require device to be marked as compliant' under Grant controls, which ensures only devices that meet compliance policies (e.g., Intune-managed) are allowed. Both assignments are necessary to satisfy the two distinct requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant access, require Microsoft Entra hybrid joined device
Why it's wrong here
Hybrid join is not required for compliance; compliance is based on Intune policy.
- ✗
Grant access, block access for non-compliant devices
Why it's wrong here
'Block access' is a separate control; you cannot combine grant and block in the same policy.
- ✓
Grant access, require multi-factor authentication
Why this is correct
This enforces MFA for access.
- ✓
Grant access, require device to be marked as compliant
Why this is correct
This ensures only compliant devices can access.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.