hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: Is implementing a Zero Trust identity strategy
An organization is implementing a Zero Trust identity strategy. They have a mix of on-premises Active Directory and Azure AD. They want to enforce conditional access policies that require device compliance for accessing sensitive apps. However, some users report that their devices are not being evaluated for compliance even though they are enrolled in Microsoft Intune. What should the organization check first?
⚠ Common exam trap
It's easy for candidates to assume Intune enrollment alone is sufficient for device compliance evaluation, but Azure AD registration is the prerequisite that links the device identity to Azure AD for Conditional Access to enforce compliance policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that devices are registered in Azure AD
Device compliance evaluation in a hybrid identity environment requires that devices are registered in Azure AD (Azure AD Registration) so that Azure AD can associate the device identity with Intune compliance data. Even if a device is enrolled in Intune, without Azure AD registration, Conditional Access policies cannot evaluate its compliance status because the device identity is not recognized by Azure AD during authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensure Intune compliance policies are assigned to the correct user groups
Why it's wrong here
Assigning Intune compliance policies to the correct user groups is an important post-registration step, but it does not address the missing prerequisite. If a device has not been registered in Azure AD, Intune cannot receive a compliance state for that device, so Conditional Access will either block or ignore the compliance requirement. Proper group scoping ensures the right users receive policies, yet without device registration there is no device to evaluate.
- ✗
Confirm that devices are Azure AD Joined
Why it's wrong here
Requiring Azure AD Join is too restrictive; Azure AD Registered devices—commonly used for BYOD—can also be enrolled in Intune and report compliance. Conditional Access evaluates any device that has an Azure AD identity, whether joined or registered, as long as that identity exists. Mandating Join would prevent compliant registered devices from being recognized, whereas the actual gap is the absence of any device registration.
- ✗
Check if users have enabled multi-factor authentication
Why it's wrong here
Multi-factor authentication verifies the user’s identity, not the security posture of the device. In Conditional Access, MFA and device compliance are separate grant controls that can be applied independently. A user who satisfies MFA but has an unregistered device will still fail a policy that requires a compliant device because compliance evaluation requires a device identity registered with Azure AD and enrolled in management.
- ✓
Verify that devices are registered in Azure AD
Why this is correct
Device registration in Azure AD creates the unique device identity that ties the user, device, and compliance state together. Conditional Access’s 'Require device to be marked as compliant' grant depends on the device being registered (via Azure AD Join or Azure AD Registered) and having its compliance status reported by Intune. Without this registration, the compliance claim is absent, and the access request is blocked.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.