Requiring Compliant Devices for Exchange Online with Conditional Access
Your organization uses Microsoft Entra ID joined devices with Windows 10. You need to ensure that only compliant devices can access corporate email in Microsoft Outlook for Windows. Which integration should you enable?
⚠ Common exam trap
Many candidates confuse App Protection Policies (which protect data at the app level) with device compliance enforcement, or assume that Intune compliance policies alone block access without a Conditional Access policy to enforce them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy in Microsoft Entra ID requiring compliant devices for Exchange Online.
Creating a Conditional Access policy in Microsoft Entra ID that requires compliant devices for Exchange Online is the correct integration because it directly enforces device compliance as a condition for accessing corporate email. This policy evaluates the device's compliance status reported by Intune before granting access to Exchange Online, ensuring only compliant devices can use Outlook for Windows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Conditional Access policy in Microsoft Entra ID requiring compliant devices for Exchange Online.
Why this is correct
Conditional Access enforces compliance at authentication, querying Intune device state before issuing tokens to Exchange Online. This satisfies the stem's requirement that only compliant devices reach corporate email, since Outlook for Windows authenticates against Microsoft Entra ID and the policy blocks non-compliant devices regardless of network location.
- ✗
Enable App Protection Policies for Outlook for Windows.
Why it's wrong here
App Protection Policies safeguard organisational data within apps on unmanaged or personally owned devices; they do not verify device health, so non-compliant devices still reach Outlook. Conditional Access with a compliance requirement is what enforces device compliance. App Protection Policies suit BYOD without enrolment.
- ✗
Require all devices to be enrolled in Intune before accessing email.
Why it's wrong here
Enrolling devices in Intune alone does not evaluate compliance; it only provides management. Conditional Access is what blocks Outlook when a device is non-compliant. This option is tempting because enrolment is a prerequisite for compliance policies, but it is the policy evaluation and Conditional Access grant that enforce access, not enrolment itself.
- ✗
Configure a compliance policy in Intune to mark devices as non-compliant if not updated.
Why it's wrong here
A compliance policy only marks devices non-compliant; it does not itself block Outlook. Conditional Access must be configured to require compliant devices for the Exchange Online grant. This option is tempting because compliance policies are essential to the solution, but without Conditional Access the policy has no enforcement effect on email access.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Device compliance
Device compliance is the process of ensuring that a device meets an organization's security and configuration policies before it can access network resources.
About these practice questions
Courseiva writes every MD-102 question from scratch — 556 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.