Enforcing Device Compliance with Conditional Access and Intune

Quick Answer

Microsoft Intune paired with Conditional Access in Microsoft Entra ID is the combination that restricts Microsoft 365 access to managed, compliant devices only, because the two services divide the work of assessing and enforcing device health. Intune defines compliance policies covering requirements such as disk encryption, a minimum OS version, or the device not being jailbroken or rooted, and it continuously evaluates every enrolled device against those requirements, reporting each one as compliant or non-compliant. That compliance status on its own does not block anything, though — Conditional Access is what actually evaluates a sign-in attempt and checks the reported device compliance state before granting or denying access to a resource like Exchange Online or SharePoint. This assess-then-enforce pattern recurs throughout the exam whenever a scenario mentions restricting access based on device health or management status, and both Intune and Conditional Access typically need to be named together for the answer to be complete.