MD-102 Protect devices Practice Question
Your organization uses Microsoft Intune to manage iOS and Android devices. You have a compliance policy that requires a minimum OS version: iOS 16.0 and Android 12.0. You also have a Conditional Access policy that requires compliant devices. Several users report that they cannot access corporate email on their personal Android devices. The devices are Android 11.0. You need to allow these users to access email while ensuring that corporate data is protected. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy that grants access but requires app protection policies and session controls.
It allows access from non-compliant devices while enforcing data protection through app protection policies (MAM) and session controls, such as limiting access to the web or approved apps. This balances security and usability. Option A is incorrect because removing the Conditional Access policy entirely would allow all devices, including those that are non-compliant, without any data protection. Option B is incorrect because lowering the minimum OS version in the compliance policy weakens the security baseline and may not align with organizational requirements. Option D is incorrect because upgrading devices may not be immediately possible for all users, and the organization needs a solution that works with existing devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the Conditional Access policy for these users.
Why it's wrong here
Removing Conditional Access for these users bypasses the compliance requirement entirely, leaving corporate email accessible from non-compliant Android 11.0 devices without data protection. It is tempting because it immediately restores access, but Conditional Access is the control enforcing compliance, so removing it defeats the security objective.
- ✗
Update the compliance policy to accept Android 11.0.
Why it's wrong here
Lowering the compliance policy to accept Android 11.0 weakens the security baseline and still does not protect corporate data on personal devices. It is tempting because it unblocks the affected users quickly, but the requirement is to protect corporate data while allowing access, not to relax the minimum OS version.
- ✓
Create a Conditional Access policy that grants access but requires app protection policies and session controls.
Why this is correct
App protection policies with session controls let Android 11.0 devices reach email without meeting the OS-version compliance bar, because Conditional Access evaluates Intune app protection as a separate grant control rather than device compliance. Corporate data stays contained through encryption, selective wipe and copy/paste restrictions, satisfying the requirement to protect data on non-compliant personal devices.
- ✗
Ask users to upgrade their devices to Android 12.0.
Why it's wrong here
Upgrading to Android 12.0 satisfies the minimum OS version, but the users' personal devices are not enrolled as corporate-owned, so the corporate data protection requirement is unmet. It is tempting because raising the OS version directly clears the compliance failure, yet it does not address protecting corporate data on personal devices.
Go deeper
Related to this question
Learn chapter
Implementing App Protection Policies (MAM)
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every MD-102 question from scratch — 556 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.