MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
You are the Microsoft 365 administrator for a company that has a Microsoft 365 E3 tenant. The company wants to ensure that users can only access Microsoft 365 services from compliant devices. You need to configure a policy that enforces this requirement. What should you create?
⚠ Common exam trap
The trap here is assuming that an Intune compliance policy alone can block access, when it only reports compliance and requires Conditional Access to enforce.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Microsoft Entra Conditional Access policy that requires the device to be marked as compliant.
To enforce that users can only access Microsoft 365 services from compliant devices, you must use a Microsoft Entra Conditional Access policy. This policy evaluates device compliance status at sign-in and grants or blocks access accordingly. Intune compliance policies alone do not enforce access; they only determine compliance status.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A Microsoft 365 compliance policy in the Microsoft Purview compliance portal that restricts access to SharePoint Online.
Why it's wrong here
Microsoft Purview compliance policies are for data governance, such as retention and DLP, not for device-based access control. They cannot enforce that devices be compliant for accessing Microsoft 365 services. This is outside the scope of Purview compliance policies.
- ✗
An Intune device compliance policy that blocks access to Exchange Online.
Why it's wrong here
Intune device compliance policies evaluate device settings and mark devices as compliant or non-compliant, but they do not enforce access to services. Enforcement is done through Conditional Access. A compliance policy alone cannot block access to Exchange Online; it only reports compliance status.
- ✓
A Microsoft Entra Conditional Access policy that requires the device to be marked as compliant.
Why this is correct
Conditional Access policies in Microsoft Entra ID can enforce that devices must be marked as compliant by Intune or another MDM solution before granting access to Microsoft 365 services. This directly meets the requirement by evaluating device compliance at sign-in and blocking non-compliant devices.
- ✗
A Microsoft Defender for Cloud Apps session policy that blocks downloads from non-compliant devices.
Why it's wrong here
Defender for Cloud Apps session policies can control actions within a session, such as blocking downloads, but they do not enforce device compliance for initial access. They operate after sign-in and do not prevent access to services based on device compliance. This does not meet the requirement.
Go deeper
Related to this question
Learn chapter
Anti-Spam and Anti-Malware Policies
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.