Design security operations, identity, and compliance capabilities →mediumMultiple SelectObjective-mapped
Device Compliance and Hybrid Azure AD Join for Conditional Access
Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows only hybrid Azure AD joined devices to access a sensitive application. The solution must also require that the device is compliant with company policies. Which two components should you configure? (Choose TWO.)
Quick Answer
This design needs two separate grant controls because the scenario is asking for two different guarantees at once: proof of what the device is, and proof of what state the device is in. A Conditional Access policy with the 'Require hybrid Azure AD joined device' control answers the identity question — it only allows access from devices that are joined to both the on-premises Active Directory and Microsoft Entra ID, which is the specific device type the scenario names. An Intune device compliance policy answers the state question separately, evaluating the device against defined security requirements like disk encryption or OS version and marking it compliant or not; Conditional Access can then reference that compliance status as its own grant control. Neither control substitutes for the other: a hybrid-joined device that fails compliance still shouldn't get in, and a compliant device that isn't hybrid-joined doesn't satisfy the device-type requirement either. It's worth distinguishing this pairing from an Intune app protection policy, which secures data inside a specific app regardless of overall device state, and from device enrollment, which is the prerequisite that lets Intune manage the device at all but isn't itself an access control. When a scenario names both a device type and a compliance requirement, expect both a device-join grant control and a compliance policy in the answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policy with 'Require hybrid Azure AD joined device'
Options C and E are correct. A Conditional Access policy with the 'Require hybrid Azure AD joined device' grant control ensures that only devices joined to both on-premises AD and Azure AD can access the application. An Intune device compliance policy defines the security and configuration requirements that devices must meet to be considered compliant. Combining these two components enforces both device identity and compliance. Option A (Intune app protection policy) is incorrect because it protects app data at the app level, not device-level access. Option B (Require MFA) is not required by the scenario. Option D (Intune device enrollment) is a prerequisite for management but not an access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Intune app protection policy
Why it's wrong here
App protection policies are for app-level data protection, not device access.
- ✗
Conditional Access policy with 'Require multifactor authentication'
Why it's wrong here
MFA is not specified in the requirements.
- ✓
Conditional Access policy with 'Require hybrid Azure AD joined device'
Why this is correct
This ensures only hybrid Azure AD joined devices can access the application.
- ✗
Intune device enrollment
Why it's wrong here
Enrollment is a prerequisite but does not enforce access control.
- ✓
Intune device compliance policy
Why this is correct
Compliance policies define the security requirements for devices.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows corporate users to access a sensitive internal application only from managed devices that are compliant with company security policies. The solution should block access from personal devices. Which two components should you use? (Choose TWO.)
hard- A.Microsoft Intune app protection policy
- B.Microsoft Entra ID Conditional Access policy that requires hybrid Azure AD join
- C.Microsoft Intune device enrollment
- ✓ D.Microsoft Intune device compliance policy
- ✓ E.Microsoft Entra ID Conditional Access policy that requires a compliant device
Why D: To block access from personal devices and allow only managed, compliant devices, you need both a device compliance policy (D) to define security requirements and a Conditional Access policy (E) that requires a compliant device. Intune device compliance policy enforces conditions like encryption and OS version, and Entra ID Conditional Access uses the compliance status to grant or block access. App protection policies (A) are for app-level protection, not device-level. Hybrid Azure AD join (B) is not required; a compliant device can be cloud-joined. Enrollment (C) is a prerequisite but not the enforcement mechanism itself.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.