Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

```powershell
# Microsoft Intune PowerShell script to retrieve device compliance policies
Get-DeviceCompliancePolicy | Select-Object -Property DisplayName, IsAssigned
```

A tenant administrator runs the PowerShell cmdlet shown in the exhibit. The output shows that some compliance policies have IsAssigned = $false. What does this indicate?

⚠ Common exam trap

Many candidates confuse `IsAssigned` with compliance evaluation status or policy type, mistakenly thinking it indicates future scheduling, non-compliance, or built-in restrictions, rather than understanding it simply reflects whether the policy has been assigned to a group.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The compliance policy is not assigned to any user or device group

The `IsAssigned` property in the output of a compliance policy PowerShell cmdlet (such as `Get-DeviceCompliancePolicy`) directly indicates whether the policy has been assigned to any user or device group. When `IsAssigned = $false`, it means the policy exists in the tenant but has not been linked to any group via an assignment, so it is not being enforced on any devices. This is a core concept in Microsoft Intune and Microsoft 365 compliance: a policy must be assigned to a group to take effect.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The compliance policy is scheduled to be assigned in the future
Why it's wrong here
The IsAssigned property in Intune compliance policy cmdlets is a boolean value that reflects the policy's *current* assignment status. A False value indicates that the policy is not presently deployed to any user or device groups. It does not provide information about future scheduled assignments or pending deployments; such states would typically be managed through separate scheduling mechanisms or reflected by other properties once the assignment becomes active.
✓
The compliance policy is not assigned to any user or device group
Why this is correct
When the IsAssigned property for an Intune compliance policy returns False, it directly and unambiguously indicates that the policy has not been targeted or deployed to any user groups, device groups, or the entire tenant. For a compliance policy to become active, enforce settings, and report on device or user compliance, it must be explicitly assigned to the relevant scope within Microsoft Intune.
✗
The compliance policy has been evaluated and found non-compliant
Why it's wrong here
The IsAssigned property solely communicates whether a compliance policy has been deployed to a target group. It provides no information regarding the evaluation status or compliance state of devices or users. Compliance evaluation, including determining if devices are compliant or non-compliant, occurs *after* a policy has been assigned, delivered to devices, and processed, with results reported through separate compliance reporting mechanisms.
✗
The compliance policy is a built-in policy that cannot be assigned
Why it's wrong here
The IsAssigned property indicates the assignment status of a policy, regardless of whether it is custom-created or a built-in policy provided by Microsoft Intune. While certain highly specialized system policies might not be assignable, the vast majority of built-in compliance policies are designed to be assigned to user or device groups. Therefore, IsAssigned: False simply means it's not currently assigned, not that it's inherently unassignable due to being built-in.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question