MD-102 Manage and maintain devices Practice Question
You are the endpoint administrator for Contoso, a company with 10,000 Windows 11 devices managed by Microsoft Intune. The devices are a mix of corporate-owned and bring-your-own-device (BYOD). You need to implement a solution that allows users to access corporate resources only if their devices meet specific security requirements: disk encryption (BitLocker), antivirus (Microsoft Defender), and a minimum OS build. Additionally, you must ensure that users cannot access corporate email from devices that are jailbroken or rooted. The solution should automatically block non-compliant devices from accessing resources and provide a notification to the user explaining the issue. You have already configured compliance policies in Intune. What should you do next to enforce the block?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy in Microsoft Entra ID that requires compliant device for access.
Conditional Access policies in Microsoft Entra ID can evaluate device compliance status from Intune to grant or block access to corporate resources like Exchange Online. When a device is marked non-compliant (e.g., missing BitLocker, outdated OS, jailbroken/rooted), the Conditional Access policy blocks access and can display a notification. Option A is incorrect because device enrollment restrictions only control whether a device can enroll in Intune or join Azure AD; they do not enforce access after enrollment. Option B is incorrect because device configuration policies apply settings but do not enforce access control. Option C is incorrect because app protection policies protect data within apps but rely on device compliance for access decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a device enrollment restriction to block non-compliant devices from Azure AD join.
Why it's wrong here
Enrollment restrictions apply at enrollment time, not for ongoing access.
- ✗
Create a device configuration policy that blocks access to corporate resources.
Why it's wrong here
Device configuration policies enforce settings but do not block access; they are not access control mechanisms.
- ✗
Create an app protection policy in Intune to block access to apps.
Why it's wrong here
App protection policies protect data within managed apps but do not block access based on device compliance; they require managed apps.
- ✓
Create a Conditional Access policy in Microsoft Entra ID that requires compliant device for access.
Why this is correct
Conditional Access evaluates device compliance and blocks access if not compliant, with user notification.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.