Deploy and manage a Microsoft 365 tenant →hardMultiple Choice

How a Conditional Access Policy Enforces MFA and Device Compliance on Mobile

Exhibit

Refer to the exhibit.
```json
{
  "conditions": {
    "applications": {
      "includeApplications": ["Office365"]
    },
    "users": {
      "includeUsers": ["All"]
    },
    "platforms": {
      "includePlatforms": ["iOS", "Android"]
    }
  },
  "grantControls": {
    "builtInControls": ["mfa", "compliantDevice"]
  }
}
```

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. What is the effect of this policy?

Quick Answer

The correct answer is that all users on iOS or Android devices accessing Office 365 must use MFA and a compliant device. This policy works by combining two grant controls—Require multi-factor authentication and Require device to be marked as compliant—which forces the user to satisfy both conditions before access is granted. The conditions section explicitly filters for iOS and Android device platforms, meaning the policy only applies when a mobile device is detected, while the target is set to All users and Office 365 as the cloud app. On the MS-102 exam, this scenario tests your ability to read a Conditional Access policy’s assignment, conditions, and grant blocks together; a common trap is assuming that MFA alone suffices or that the policy applies to all devices. Remember the memory tip: “Mobile means MFA plus compliant” — if you see iOS or Android in conditions, look for both grant controls to be checked.

⚠ Common exam trap

The trap here is that candidates may misinterpret 'Require device to be marked as compliant' as requiring hybrid Microsoft Entra ID join, but compliance is a separate concept managed by Intune and does not mandate hybrid join.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

All users on iOS or Android devices accessing Office 365 must use MFA and a compliant device

The policy shown in the exhibit explicitly targets 'All users' and 'Office 365' as the cloud app, with conditions for 'iOS' and 'Android' device platforms. The grant controls require both 'Require multi-factor authentication' and 'Require device to be marked as compliant', meaning any user on an iOS or Android device accessing Office 365 must satisfy both MFA and device compliance. This is a common Conditional Access policy to enforce secure access from mobile devices.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
All users accessing all cloud apps are required to use MFA
Why it's wrong here
The exhibit scopes the policy to a subset of users or apps, so it does not require MFA for every user across all cloud apps. It is tempting because an unscoped MFA grant is the correct design when an organisation mandates phishing-resistant authentication universally.
✗
Access to Office 365 from iOS and Android is blocked
Why it's wrong here
The policy targets iOS and Android device platforms, so it cannot block Office 365 access from those platforms unless those platforms are the configured condition. Blocking iOS and Android is what a platform condition set to those values would achieve.
✓
All users on iOS or Android devices accessing Office 365 must use MFA and a compliant device
Why this is correct
The policy targets all users, with device platforms restricted to iOS and Android, and cloud apps restricted to Office 365. Both grant controls, require multifactor authentication and require device to be marked as compliant, are selected with the AND operator, so both must be satisfied before access is granted.
✗
Users on mobile devices are required to use hybrid Microsoft Entra ID joined devices
Why it's wrong here
Hybrid Microsoft Entra ID joined device controls apply only to Windows desktops, not mobile platforms, so the policy cannot enforce this on iOS or Android. It is tempting because hybrid join is the correct control when you need corporate Windows devices to satisfy Conditional Access through on-premises domain registration.

Go deeper

1 more way this is tested on MS-102

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. You are reviewing a Conditional Access policy in Microsoft Entra ID. The exhibit shows the policy configuration. You need to allow users to access Office 365 applications from personal devices that are not enrolled in Microsoft Intune. However, the policy currently blocks access because it requires a compliant device. Users are prompted for MFA but then blocked due to device compliance. What should you modify in the policy?

hard

A.Add a session control for sign-in frequency.
✓ B.Remove "compliantDevice" from the builtInControls grant control list.
C.Remove the cloudAppSecurity session control.
D.Change cloudAppSecurityType to "blockDownloads".

Why B: The policy currently uses the 'Require compliant device' grant control, which blocks access from devices not enrolled in Intune or not meeting compliance policies. Removing 'compliantDevice' from the builtInControls list allows access from personal, non-enrolled devices while still enforcing MFA. This directly resolves the scenario where users pass MFA but are blocked by device compliance.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.

How a Conditional Access Policy Enforces MFA and Device Compliance on Mobile

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on MS-102