MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
You are the Microsoft 365 administrator for a company that uses Microsoft 365 E5. The company has a Microsoft Entra tenant with 10,000 users. You need to ensure that when users sign in to Microsoft 365 from unmanaged devices, they are required to use multi-factor authentication (MFA) and cannot download files from SharePoint Online. Users on managed devices should not be prompted for MFA and should be able to download files. What should you configure?
⚠ Common exam trap
A common mix-up: candidates confuse app enforced restrictions with device compliance, or incorrectly excluding unmanaged devices when the policy should target them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Include: Unmanaged', and grant access with 'Require multifactor authentication' and 'Require app enforced restrictions'.
A conditional access policy targeting unmanaged devices with MFA and app enforced restrictions ensures that users on unmanaged devices must use MFA and are subject to restrictions that prevent downloads from SharePoint Online. Managed devices are not targeted by this policy, so they are not prompted for MFA and can download files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Include: Unmanaged', and grant access with 'Require multifactor authentication' and 'Require device to be marked as compliant'.
Why it's wrong here
This policy requires both MFA and a compliant device for unmanaged devices. Since unmanaged devices cannot be marked as compliant, this would block access entirely, not just prevent downloads. The requirement is to allow access with MFA but block downloads, so this policy is too restrictive.
- ✗
Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Exclude: Unmanaged', and grant access with 'Require multifactor authentication' and 'Require app enforced restrictions'.
Why it's wrong here
This policy applies to managed devices (by excluding unmanaged) and would require MFA and app enforced restrictions on them. That is the opposite of the requirement, which states managed devices should not be prompted for MFA and should allow downloads. This policy would incorrectly restrict managed devices.
- ✗
Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Include: Unmanaged', and grant access with 'Require device to be marked as compliant' and 'Require app enforced restrictions'.
Why it's wrong here
This policy requires a compliant device and app enforced restrictions for unmanaged devices. Unmanaged devices cannot be compliant, so access would be blocked, not limited. The requirement is to allow access with MFA but block downloads, so this policy fails to provide the MFA prompt and blocks access entirely.
- ✓
Create a conditional access policy that targets all users and SharePoint Online, set the device state condition to 'Include: Unmanaged', and grant access with 'Require multifactor authentication' and 'Require app enforced restrictions'.
Why this is correct
This policy applies to unmanaged devices and requires MFA while enabling app enforced restrictions. App enforced restrictions allow SharePoint Online to provide limited access, such as blocking downloads, on unmanaged devices. This meets the requirement for MFA and no downloads on unmanaged devices.
Go deeper
Related to this question
Learn chapter
Entra ID Administration
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.