How a Conditional Access Policy Enforces MFA and Device Compliance on Mobile
Exhibit
Refer to the exhibit.
```json
{
"conditions": {
"applications": {
"includeApplications": ["Office365"]
},
"users": {
"includeUsers": ["All"]
},
"platforms": {
"includePlatforms": ["iOS", "Android"]
}
},
"grantControls": {
"builtInControls": ["mfa", "compliantDevice"]
}
}
```Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. What is the effect of this policy?
Quick Answer
The correct answer is that all users on iOS or Android devices accessing Office 365 must use MFA and a compliant device. This policy works by combining two grant controls—Require multi-factor authentication and Require device to be marked as compliant—which forces the user to satisfy both conditions before access is granted. The conditions section explicitly filters for iOS and Android device platforms, meaning the policy only applies when a mobile device is detected, while the target is set to All users and Office 365 as the cloud app. On the MS-102 exam, this scenario tests your ability to read a Conditional Access policy’s assignment, conditions, and grant blocks together; a common trap is assuming that MFA alone suffices or that the policy applies to all devices. Remember the memory tip: “Mobile means MFA plus compliant” — if you see iOS or Android in conditions, look for both grant controls to be checked.
⚠ Common exam trap
The trap here is that candidates may misinterpret 'Require device to be marked as compliant' as requiring hybrid Azure AD join, but compliance is a separate concept managed by Intune and does not mandate hybrid join.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
All users on iOS or Android devices accessing Office 365 must use MFA and a compliant device
The policy shown in the exhibit explicitly targets 'All users' and 'Office 365' as the cloud app, with conditions for 'iOS' and 'Android' device platforms. The grant controls require both 'Require multi-factor authentication' and 'Require device to be marked as compliant', meaning any user on an iOS or Android device accessing Office 365 must satisfy both MFA and device compliance. This is a common Conditional Access policy to enforce secure access from mobile devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All users accessing all cloud apps are required to use MFA
Why it's wrong here
The policy only applies to Office 365 apps.
- ✗
Access to Office 365 from iOS and Android is blocked
Why it's wrong here
The policy grants access with conditions, not blocks.
- ✓
All users on iOS or Android devices accessing Office 365 must use MFA and a compliant device
Why this is correct
The policy includes both MFA and compliantDevice controls.
- ✗
Users on mobile devices are required to use hybrid Azure AD joined devices
Why it's wrong here
The policy does not require hybrid join.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Device compliance
Device compliance is the process of ensuring that a device meets an organization's security and configuration policies before it can access network resources.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are reviewing a Conditional Access policy in Microsoft Entra ID. The exhibit shows the policy configuration. You need to allow users to access Office 365 applications from personal devices that are not enrolled in Microsoft Intune. However, the policy currently blocks access because it requires a compliant device. Users are prompted for MFA but then blocked due to device compliance. What should you modify in the policy?
hard- A.Add a session control for sign-in frequency.
- ✓ B.Remove "compliantDevice" from the builtInControls grant control list.
- C.Remove the cloudAppSecurity session control.
- D.Change cloudAppSecurityType to "blockDownloads".
Why B: The policy currently uses the 'Require compliant device' grant control, which blocks access from devices not enrolled in Intune or not meeting compliance policies. Removing 'compliantDevice' from the builtInControls list allows access from personal, non-enrolled devices while still enforcing MFA. This directly resolves the scenario where users pass MFA but are blocked by device compliance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.