Design solutions that align with security best practices and priorities →easyMultiple ChoiceObjective-mapped

SC-100 Practice Question: Design solutions that align with security best practices and priorities

Your organization uses Microsoft Intune for mobile device management. You need to ensure that only devices compliant with security policies can access corporate email. What should you implement?

⚠ Common exam trap

Test-takers frequently confuse Intune App Protection Policies (MAM) with device-based compliance, but MAM policies protect data at the app level and do not require the device itself to be compliant, so they do not meet the requirement of 'only compliant devices'.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Conditional Access policy requiring compliant device

A is correct because a Conditional Access policy in Microsoft Entra ID can evaluate device compliance status reported by Intune before granting access to corporate email. By configuring a policy that requires a device to be marked as compliant, only devices that meet your security policies (e.g., encryption, OS version, threat level) will be allowed to authenticate and access email. This directly enforces the requirement that only compliant devices can access corporate email.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Conditional Access policy requiring compliant device
Why this is correct
A Conditional Access policy requiring a compliant device acts as a real-time access gate at authentication, checking the device's compliance state reported by Intune against defined compliance policies. It evaluates signals such as enrollment status, device health attestation, and configured security settings, and blocks or allows access to Microsoft 365 or other cloud apps. This is the appropriate control because it enforces device-level access decisions before any session begins.
✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management focuses on managing data across its lifecycle—retention, deletion, and disposition—using policies for records management and retention labels. It does not evaluate device state or enforce conditional access decisions when a user attempts to access a cloud resource. Therefore, it cannot ensure that only compliant devices are granted access, making it the wrong tool for this requirement.
✗
Microsoft Defender for Endpoint integration
Why it's wrong here
Microsoft Defender for Endpoint integration provides rich threat signals and device risk scores, which can be consumed as a condition in a Conditional Access policy to block risky devices. However, by itself, Defender for Endpoint does not enforce access control; it merely reports device risk. Since the requirement is to require compliant devices, a configuration that only integrates Defender for Endpoint—without a Conditional Access policy using that risk as a condition—would not grant or deny access based on compliance.
✗
Microsoft Intune App Protection Policies
Why it's wrong here
Microsoft Intune App Protection Policies (APP) apply granular data-loss prevention controls at the application layer, such as restricting copy/paste, blocking screenshots, or preventing 'save as' to unmanaged locations. These policies do not evaluate device-level compliance or block access at the device level; they can even operate on unenrolled devices. While APP is useful for data protection, it cannot replace a device-compliance–based Conditional Access policy that gates access based on device health and enrollment.

Go deeper

SC-100 Practice Question: Design solutions that align with security best practices and priorities

Why each option matters

Option-by-option breakdown

Related to this question