MS-102 Practice Question: Require that all users accessing a critical…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Grant control 'Require multi-factor authentication' and 'Require device to be marked as compliant' with session control 'Sign-in frequency' set to 30 minutes

  Why this is correct

  This is the correct policy design because the grant controls 'Require multi-factor authentication' and 'Require device to be marked as compliant' are combined with the session control 'Sign-in frequency' set to 30 minutes. In Conditional Access, selecting multiple grant controls defaults to 'Require all the selected controls,' so a user must satisfy both MFA and Intune compliance at access time. The session control then enforces reauthentication for this application every 30 minutes, which forces MFA to be reperformed because the MFA grant is evaluated against the new sign-in event. Together they fully satisfy the requirement: every access attempt must come from a compliant device, and the user's MFA proof must be no older than 30 minutes.

• ✗

  Grant control 'Require multi-factor authentication' and 'Require device to be marked as compliant' and 'Require all the selected controls'

  Why it's wrong here

  This choice explicitly selects both grant controls and 'Require all the selected controls,' but that setting is already the default behavior for multiple grant controls, so it adds no new enforcement. The omission is the 'Sign-in frequency' session control, meaning after the initial MFA succeeds, the user can keep accessing the critical application for the lifetime of the Azure AD token/session without being asked to reauthenticate. As a result, MFA is not guaranteed to have occurred within the last 30 minutes, which fails the core timing requirement.

• ✗

  Grant control 'Require multi-factor authentication' and 'Require hybrid Azure AD joined device' with session control 'App enforced restrictions'

  Why it's wrong here

  Substituting 'Require hybrid Azure AD joined device' for 'Require device to be marked as compliant' changes the meaning: hybrid Azure AD join proves the device is domain-joined and has an identity in Azure AD, but it does not inherently prove the device is compliant with Intune policies. 'App enforced restrictions' is a session control that delegates enforcement to the application (primarily Exchange and SharePoint) and has no bearing on sign-in frequency. Therefore this policy could allow a domain-joined but non-compliant device to authenticate, and it still lacks the 30-minute MFA reauthentication control.

• ✗

  Grant control 'Block access' for non-compliant devices and separate policy for MFA

  Why it's wrong here

  Using two separate Conditional Access policies—one blocking non-compliant devices and one requiring MFA—is functionally fragmented and brittle because Conditional Access evaluates policies independently and combines grant results through OR-like logic unless carefully scoped. The MFA-only policy could apply to all cloud apps while the block policy applies only to this application, creating gaps if scopes are misaligned, and neither policy enforces a 30-minute sign-in frequency session control. A single policy with combined grant and session controls is the supported way to guarantee that compliant device status and fresh MFA are both required for this application.

Go deeper

Related to this question