Design security operations, identity, and compliance capabilities →hardMultiple SelectObjective-mapped
Conditional Access Components for Compliant Device Email Access
A company uses Microsoft Intune to manage devices. They need to ensure that only compliant devices can access corporate email. They plan to use Conditional Access in Microsoft Entra ID. Which THREE components must be configured?
Quick Answer
The answer is compliance policy in Intune, device registration in Microsoft Entra ID, and a Conditional Access policy targeting compliant devices. Device registration is the foundational component because Conditional Access evaluates a device’s compliance status based on its unique identity in Entra ID; without registration, the device lacks an identity that Entra ID can assess, making enforcement impossible. On the Microsoft Cybersecurity Architect exam, this scenario tests your understanding of how Intune compliance policies and Entra ID device identities work together to gate email access—a common trap is forgetting that registration is required before a compliance policy can be evaluated. Remember the sequence: register the device, apply a compliance policy, then create a Conditional Access policy that requires compliant device status. A useful mnemonic is “RCP” for Register, Comply, Protect.
⚠ Common exam trap
Watch out — candidates often confuse Configuration profiles (which apply settings) with Compliance policies (which define security requirements), leading them to incorrectly select Configuration profile instead of Compliance policy for enforcing device-based access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Device registration in Entra ID
Device registration in Entra ID (A) is required because Conditional Access policies evaluate device compliance based on the device's identity in Entra ID. Without registration, the device lacks a unique identity that Entra ID can assess for compliance status, making it impossible to enforce access controls based on device state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Device registration in Entra ID
Why this is correct
Devices must be registered to be evaluated.
- ✓
Conditional Access policy in Entra ID
Why this is correct
Enforces access control based on compliance.
- ✗
Windows Autopilot deployment profile
Why it's wrong here
Autopilot is for initial provisioning.
- ✓
Compliance policy in Intune
Why this is correct
Defines compliance requirements.
- ✗
Configuration profile in Intune
Why it's wrong here
Configuration profiles configure device settings, not compliance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Microsoft Intune to manage devices. They need to ensure that only devices with a minimum OS version can access corporate email. Which policy type should they implement?
medium- A.Device enrollment restrictions
- B.App protection policies
- ✓ C.Compliance policies combined with conditional access
- D.Device configuration profiles
Why C: Compliance policies define required conditions like minimum OS version, and conditional access enforces those conditions by blocking or allowing access to corporate email. Option A is wrong because device enrollment restrictions control which devices can enroll in Intune, not post-enrollment access. Option B is wrong because app protection policies manage data protection within apps, not device-level OS version requirements. Option D is wrong because device configuration profiles manage device settings (e.g., Wi-Fi, VPN), not access enforcement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.