Design security operations, identity, and compliance capabilities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?
⚠ Common exam trap
Watch out — candidates often confuse device configuration policies (which set device settings) with Conditional Access (which enforces access control based on compliance), leading them to choose option C instead of the correct policy-based access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy that requires compliant device
A Conditional Access policy in Microsoft Entra ID (formerly Azure AD) can enforce the requirement that only devices marked as compliant by Intune can access corporate email. This policy evaluates the device compliance status at authentication time and blocks or grants access based on that signal, ensuring that only managed and compliant devices can connect to services like Exchange Online.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Conditional Access policy that requires compliant device
Why this is correct
Conditional Access policies are the access-control layer that evaluates the device's compliance state at sign-in. When combined with an Intune compliance policy, the 'Require device to be marked as compliant' grant control forces Azure AD to check the device's compliance status and block access if the device is non-compliant. This is the correct approach because it directly enforces the access requirement for corporate resources, unlike enrollment or configuration policies that only manage settings or enrollment.
- ✗
Set up enrollment restrictions in Intune
Why it's wrong here
Enrollment restrictions in Intune define who can enroll, which device platforms are allowed, and whether personally owned devices are prohibited. They act as a gate at the moment of device enrollment, not as a persistent access policy for devices already enrolled. Once a device is enrolled, enrollment restrictions have no bearing on its ongoing compliance or its ability to access corporate resources, so they cannot satisfy the requirement to ensure only compliant devices get access.
- ✗
Create a device configuration policy that blocks non-compliant devices
Why it's wrong here
A device configuration policy in Intune applies settings such as password policies, encryption requirements, and restrictions to devices, but it does not evaluate or enforce access decisions. Even if a device becomes non-compliant because it violates a configuration setting, Intune merely marks the device as non-compliant; no access block occurs unless a separate Conditional Access policy consumes that compliance status. Thus, a configuration policy alone cannot enforce that only compliant devices can access resources.
- ✗
Configure an app protection policy for email apps
Why it's wrong here
App protection policies (MAM) are designed to protect corporate data within specific applications by requiring PINs, restricting copy/paste, and preventing backups to personal storage. They can apply without device enrollment and focus on data loss prevention at the app layer, not on whether the entire device meets compliance standards. An app protection policy does not block access to other corporate resources and cannot replace the device-level compliance check that a Conditional Access policy provides.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.