MD-102 Prepare infrastructure for devices Practice Question
Your organization has Windows 11 devices used by remote employees. You need to ensure that only devices compliant with your security policies can access corporate email via Microsoft Outlook for Windows. What should you configure?
⚠ Common exam trap
Candidates often confuse device compliance enforcement with email security profiles or legacy device filters, not realizing that Conditional Access in Entra ID is the only modern, cloud-native method to gate access based on Intune compliance for Exchange Online.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy in Microsoft Entra ID that requires device compliance, and assign the policy to the cloud app 'Office 365 Exchange Online'.
Conditional Access policies in Microsoft Entra ID are the primary mechanism to enforce device compliance before granting access to cloud apps like Office 365 Exchange Online. By creating a policy that requires device compliance and targeting the 'Office 365 Exchange Online' app, only devices that meet your security policies (e.g., encryption, antivirus, patch level) can authenticate and access corporate email via Outlook for Windows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set up a device compliance policy in Microsoft Purview to block non-compliant devices.
Why it's wrong here
Microsoft Purview does not handle device compliance for access control; that is Intune's role.
- ✓
Create a Conditional Access policy in Microsoft Entra ID that requires device compliance, and assign the policy to the cloud app 'Office 365 Exchange Online'.
Why this is correct
This correctly combines Intune compliance with Entra ID Conditional Access to block non-compliant devices.
- ✗
Configure a device filter in Exchange Online to block devices that are not managed by Intune.
Why it's wrong here
Device filters in Exchange Online do not evaluate Intune compliance status.
- ✗
Deploy an email security policy via Intune to block access from non-compliant devices.
Why it's wrong here
Intune email profiles do not enforce compliance-based access blocking.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Windows 11
Windows 11 is Microsoft's latest desktop operating system, offering a redesigned interface, enhanced security features, and improved support for modern hardware.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This MD-102 question is part of Courseiva's 942-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.