Deploy and manage a Microsoft 365 tenant →hardMultiple ChoiceObjective-mapped

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "conditions": {
    "applications": {
      "includeApplications": ["Office365"]
    },
    "users": {
      "includeUsers": ["All"]
    },
    "locations": {
      "includeLocations": ["All"]
    }
  },
  "grantControls": {
    "builtInControls": ["mfa", "compliantDevice"]
  },
  "sessionControls": {
    "applicationEnforcedRestrictions": null,
    "cloudAppSecurity": {
      "cloudAppSecurityType": "monitorOnly"
    }
  }
}
```

You are reviewing a Conditional Access policy in Microsoft Entra ID. The exhibit shows the policy configuration. You need to allow users to access Office 365 applications from personal devices that are not enrolled in Microsoft Intune. However, the policy currently blocks access because it requires a compliant device. Users are prompted for MFA but then blocked due to device compliance. What should you modify in the policy?

⚠ Common exam trap

Candidates often confuse session controls (like app enforcement or sign-in frequency) with grant controls (like device compliance), leading them to incorrectly modify session settings instead of removing the device compliance requirement.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Remove "compliantDevice" from the builtInControls grant control list.

The policy currently uses the 'Require compliant device' grant control, which blocks access from devices not enrolled in Intune or not meeting compliance policies. Removing 'compliantDevice' from the builtInControls list allows access from personal, non-enrolled devices while still enforcing MFA. This directly resolves the scenario where users pass MFA but are blocked by device compliance.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add a session control for sign-in frequency.
Why it's wrong here
This does not remove the device compliance requirement.
✓
Remove "compliantDevice" from the builtInControls grant control list.
Why this is correct
Removing the compliant device requirement allows access from any device.
✗
Remove the cloudAppSecurity session control.
Why it's wrong here
This does not remove the device compliance requirement.
✗
Change cloudAppSecurityType to "blockDownloads".
Why it's wrong here
This is a session control, not a grant control.

Visual reference

Go deeper

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question