MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
You are troubleshooting why a user cannot access a SharePoint Online site. The user is assigned a Conditional Access policy that requires compliant device, and the device is enrolled in Microsoft Intune but shows as non-compliant. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume the device is not enrolled or the policy is misconfigured, but the question explicitly confirms enrollment and policy application, forcing you to focus on the compliance state itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The device is non-compliant due to missing security updates
The user's device is enrolled in Intune but marked as non-compliant, which directly blocks access because the Conditional Access policy requires a compliant device. The most common reason for non-compliance is missing security updates, as Intune evaluates compliance based on configured policies such as required patch levels, encryption status, or threat detection. Since the device is enrolled, the issue is not enrollment or licensing, but a specific compliance rule violation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The device is non-compliant due to missing security updates
Why this is correct
The device is non-compliant because Microsoft Intune compliance policies evaluate security update installation as a required health condition. Missing security updates cause the compliance state to become 'non-compliant', which triggers the Conditional Access policy's 'Require device to be marked as compliant' grant control and blocks access to SharePoint Online. The user's license and the policy's application scope are irrelevant because the failure is specifically the device's compliance state.
- ✗
The device is not enrolled in Microsoft Intune
Why it's wrong here
The device is actually enrolled in Microsoft Intune; enrollment is not the cause of the access block. Conditional Access evaluates the device's compliance state after enrollment, and the compliance policy flagged the device as non-compliant due to missing security updates. If the device were unenrolled, the Conditional Access policy would still block, but for a different reason—lack of a managed identity—whereas here the Intune management record exists and shows non-compliance.
- ✗
The Conditional Access policy is not applied to SharePoint Online
Why it's wrong here
The Conditional Access policy does target SharePoint Online; the cloud apps assignment includes it, so the policy is evaluated during the access request. The access attempt is blocked because the grant control 'Require device to be marked as compliant' fails, not because the policy is scoped away. If the policy did not include SharePoint Online, no block would occur, but this scenario specifies that the policy applies to the service in question.
- ✗
The user does not have an Intune license
Why it's wrong here
The user must have an Intune license because the device is enrolled and its compliance status is being evaluated—enrollment requires an Intune license assigned to the user. The block is not due to missing licensing; it is the device's non-compliant state from missing security updates that fails the Conditional Access grant control. Licensing issues would typically prevent enrollment or policy assignment, not trigger a specific compliance-based access denial after enrollment.
Go deeper
Related to this question
Learn chapter
Entra ID Access Reviews
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.