MS-102 A company uses Microsoft Entra ID P2 licenses Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Assign to 'All users', condition: 'Device state (preview) is not compliant', grant: 'Require MFA', exclude: 'BreakGlass group'

  Why this is correct

  This configuration correctly targets non-compliant devices using the Device state condition, which checks the compliance status reported by Intune. When a device is not compliant, the policy requires MFA for access to the Azure Management portal, adding an extra security layer. Excluding the BreakGlass group preserves emergency access accounts from being locked out by this policy, which is a standard best practice in Conditional Access design.

• ✗

  Assign to 'All users', condition: 'Sign-in risk is medium or higher', grant: 'Require MFA', exclude: 'BreakGlass group'

  Why it's wrong here

  This policy is incorrect because the Sign-in risk condition evaluates the probability that the sign-in itself is compromised, rather than whether the device meets compliance standards. It would require MFA for sign-ins flagged as medium or high risk—a control intended for identity protection scenarios. Even a fully compliant device could trigger MFA if the user's risk level is elevated, so this condition does not satisfy the requirement to enforce MFA specifically on non-compliant devices.

• ✗

  Assign to 'All users', condition: 'Client apps: Browser and Mobile apps', grant: 'Block access', exclude: 'BreakGlass group'

  Why it's wrong here

  This policy is incorrect because blocking all browser and mobile app access is far too broad and does not require MFA at all. The grant control 'Block access' would prevent users from reaching the Azure Management portal entirely, instead of presenting an MFA challenge as intended. Additionally, the policy does not reference device compliance, so non-compliant devices would be treated identically to compliant ones, potentially disrupting access for users on managed and compliant devices.

• ✗

  Assign to 'All users', condition: 'Device platform: Android, iOS, Windows, macOS', grant: 'Require MFA', exclude: 'BreakGlass group'

  Why it's wrong here

  This policy is incorrect because the Device platform condition targets specific operating systems regardless of their compliance state. Requiring MFA on all Android, iOS, Windows, and macOS devices would also apply to compliant devices, which does not meet the stated goal of enforcing MFA only for non-compliant devices. The policy should instead use the Device state condition to filter for compliance status rather than an OS platform filter.

Go deeper

Related to this question