MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A security administrator at Contoso wants to ensure that users can only access Microsoft 365 services from compliant devices that meet specific security requirements, such as having encryption enabled and a minimum OS version. Which Microsoft 365 feature should the administrator use?
⚠ Common exam trap
Candidates often confuse device management or DLP features with access control, assuming that any device-related policy can enforce compliance for Microsoft 365 access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policies with device compliance
Conditional Access policies with device compliance allow administrators to require that devices meet specific security conditions before accessing Microsoft 365 services. This is achieved by integrating with Microsoft Intune, which evaluates device compliance and reports the status to Microsoft Entra ID. This feature directly addresses the requirement to restrict access to compliant devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Endpoint device groups
Why it's wrong here
Microsoft Defender for Endpoint device groups are used to manage and group devices for security operations, such as threat detection and response. They do not enforce conditional access based on device compliance for Microsoft 365 services. Device groups are for management, not for access control.
- ✗
Exchange Online mobile device mailbox policies
Why it's wrong here
Exchange Online mobile device mailbox policies can enforce PIN requirements and other restrictions for mobile devices accessing Exchange Online. However, they are limited to Exchange ActiveSync and do not cover all Microsoft 365 services or provide the granular device compliance conditions offered by Conditional Access.
- ✓
Conditional Access policies with device compliance
Why this is correct
Conditional Access policies can integrate with Microsoft Intune device compliance policies to allow access only from devices that meet specific security requirements. This ensures that devices are compliant with encryption, OS version, and other conditions before granting access to Microsoft 365 services.
- ✗
Microsoft Purview Data Loss Prevention device policies
Why it's wrong here
Data Loss Prevention device policies in Microsoft Purview are used to monitor and control file activities on Windows devices, such as copying to USB drives. They do not control access to Microsoft 365 services based on device compliance, so they cannot enforce the requirement.
Go deeper
Related to this question
Learn chapter
Microsoft Access and Power Apps Comparison
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.