MD-102 Prepare infrastructure for devices Practice Question
You are the administrator for a company that uses Microsoft Intune. The company has a policy that all Windows 10 devices must have a minimum OS version of 10.0.19045. You need to ensure that devices that do not meet this requirement are blocked from accessing corporate email. What should you configure?
⚠ Common exam trap
The trap here is selecting a device configuration profile to enforce OS version, but configuration profiles do not affect compliance state or conditional access decisions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A device compliance policy that sets the minimum OS version to 10.0.19045, and a conditional access policy that requires compliant devices.
To block email access for devices not meeting a minimum OS version, you need a compliance policy that defines that requirement and a conditional access policy that enforces compliance. Configuration profiles and enrollment restrictions do not evaluate compliance for access control, and MFA policies do not consider OS version. Thus, the combination of a compliance policy and a conditional access policy is required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A device configuration profile that sets the minimum OS version and a conditional access policy that requires compliant devices.
Why it's wrong here
Device configuration profiles do not evaluate compliance; they apply settings to devices. They cannot mark a device as noncompliant based on OS version. Therefore, a conditional access policy requiring compliance would not have the necessary compliance state to block email access for outdated devices.
- ✓
A device compliance policy that sets the minimum OS version to 10.0.19045, and a conditional access policy that requires compliant devices.
Why this is correct
A device compliance policy can enforce the minimum OS version, marking devices below 10.0.19045 as noncompliant. A conditional access policy that requires compliant devices will then block access to corporate email for noncompliant devices. This combination directly achieves the goal of blocking email access for outdated devices.
- ✗
A device enrollment restriction that blocks devices with an OS version lower than 10.0.19045.
Why it's wrong here
Device enrollment restrictions control which devices can enroll, not ongoing access to resources. They cannot block email access for already-enrolled devices that fall below the minimum OS version. This approach would only prevent new enrollments and does not meet the requirement to block email for existing noncompliant devices.
- ✗
A conditional access policy that requires multi-factor authentication for all users.
Why it's wrong here
A conditional access policy requiring MFA does not check device OS version. It would not block email access for devices with an outdated OS; it only adds an authentication requirement. This does not enforce the minimum OS version or prevent access from noncompliant devices.
Go deeper
Related to this question
Learn chapter
Configuring Compliance Policies
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This MD-102 question is part of Courseiva's 556-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.