MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
During a Microsoft 365 planning workshop, allow access to Exchange Online only from compliant devices. Microsoft security, identity, or compliance capability should it use?
⚠ Common exam trap
Many candidates confuse productivity apps (Forms, Stream, Planner) with security services, failing to recognize that only Intune compliance policies combined with Conditional Access can enforce device-based access controls for Exchange Online.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Intune compliance policies with Conditional Access
Microsoft Intune compliance policies define the security requirements (e.g., device encryption, jailbreak detection, minimum OS version) that a device must meet. When combined with Conditional Access in Microsoft Entra ID, you can create a policy that blocks access to Exchange Online unless the device is marked as compliant by Intune. This ensures only compliant devices can connect, directly meeting the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Forms
Why it's wrong here
Microsoft Forms is a lightweight web-based tool for creating surveys, quizzes, and data-collection forms. It does not evaluate device compliance, enforce security policies, or factor into Conditional Access engine decisions. Because it lacks any device-health or access-control capability, it cannot satisfy a requirement to allow access to Microsoft 365 only from managed, compliant devices.
- ✓
Microsoft Intune compliance policies with Conditional Access
Why this is correct
Microsoft Intune compliance policies evaluate devices against baselines such as OS version, encryption, jailbreak, and threat-check statuses, publishing a signal to Microsoft Entra ID. Conditional Access then consumes that signal through a 'Require device to be marked compliant' grant, blocking or allowing access to Microsoft 365 services accordingly. It is the only option here that directly implements both evaluation and enforcement for security-aware access control.
- ✗
Microsoft Stream
Why it's wrong here
Microsoft Stream is a video portal for hosting and sharing recorded content such as town halls and training — it does not evaluate user or device state. Even though Stream content can be protected by other policies, the service itself provides no compliance evaluation or Conditional Access enforcement. Relying on Stream alone cannot gate Microsoft 365 access, making it incorrect for a security-control requirement.
- ✗
Microsoft Planner
Why it's wrong here
Microsoft Planner is a project-management app that organizes tasks, assignments, and progress within Microsoft 365, but it never inspects device posture or treats compliance as an access condition. Its database operations and UI are subject to tenant access policies, yet Planner itself supplies no signal to Conditional Access. It is simply a productivity workload, not a security policy mechanism, so it cannot enforce device-based access decisions.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Security Center
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
This MS-900 question is part of Courseiva's 794-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.