Describe Microsoft 365 apps and services →easyMultiple ChoiceObjective-mapped

MS-900 Describe Microsoft 365 apps and services Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "displayName": "Block access for non-Microsoft Entra ID users",
  "state": "enabled",
  "conditions": {
    "applications": {
      "includeApplications": ["Office365"]
    },
    "users": {
      "includeUsers": ["All"]
    }
  },
  "grantControls": {
    "builtInControls": ["mfa", "compliantDevice"]
  }
}
```

Refer to the exhibit. You have a Conditional Access policy as shown. A user reports they cannot access Exchange Online from a non-compliant device. What is the most likely reason?

⚠ Common exam trap

It's easy for candidates to assume MFA or admin-only scoping is the issue, but the policy explicitly targets device compliance, which is the direct cause of the block.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The device is not marked as compliant

The Conditional Access policy shown requires device compliance for Exchange Online access. When a device is non-compliant, the policy blocks access regardless of user identity or MFA status. The most likely reason for the user's inability to access Exchange Online is that the device is not marked as compliant, which is the condition explicitly enforced by the policy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The device is not marked as compliant
Why this is correct
The conditional access policy includes the grant control "Require device to be marked as compliant." If the device is not enrolled in Microsoft Intune or does not meet the configured compliance policy, this control is not satisfied, and access is denied. This is the immediate and technical reason the user is blocked, regardless of other grants like MFA.
✗
The policy only applies to administrators
Why it's wrong here
This is incorrect because the policy's assignments include "All users," which explicitly covers every user in the directory, not just privileged roles like global administrators. Even if the user in question were an administrator, the policy would still apply to them, so the block cannot be attributed to any admin-only scope.
✗
The user has not registered for MFA
Why it's wrong here
Although the policy also requires MFA, the user is not blocked because they failed MFA—they are blocked because the device fails the compliance grant. If MFA registration were the issue, the sign-in would likely reach the MFA step and prompt for enrollment, but here the device compliance check occurs alongside MFA, and the non-compliant device is the unsatisfied condition.
✗
The policy is disabled
Why it's wrong here
The policy is not disabled; its state is shown as "Enabled" in the exhibit. An enabled policy actively evaluates every sign-in against its conditions. If the policy were disabled, it would not apply at all, and no grant controls would be enforced, so the user would not be blocked by it.

Go deeper

MS-900 Describe Microsoft 365 apps and services Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question