Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 E5 subscription that contains a user named User1 and the devices shown in the following table. User1 can access her Microsoft Exchange Online mailbox from both Device1 and Device2. You plan to create a Conditional Access policy named CAPolicy1 that will have the following settings:

Assignments

Users or workload identities: User1

Cloud apps or actions: Office 365 Exchange Online

Access controls

Grant: Block access

You need to configure CAPolicy1 to allow mailbox access from Device1 but block mailbox access from Device2. Solution: You add a condition that specifies trusted location. Does this meet the goal?

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 E5 subscription that contains a user named User1 and the devices shown in the following table. User1 can access her Microsoft Exchange Online mailbox from both Device1 and Device2. You plan to create a Conditional Access policy named CAPolicy1 that will have the following settings:

Assignments
Users or workload identities: User1
Cloud apps or actions: Office 365 Exchange Online
Access controls
Grant: Block access

You need to configure CAPolicy1 to allow mailbox access from Device1 but block mailbox access from Device2. Solution: You add a condition that specifies trusted location. Does this meet the goal?

Accepted Answer

B. No A Conditional Access policy assigned only to a user and cloud apps, without specific device state conditions or grant controls like "Require device to be marked as compliant", will not restrict access based on the compliance or type of the device being used. Therefore, it would not achieve an implicit goal of preventing access from non-compliant or specific devices.

Answer

A. Yes A Conditional Access policy requires specific conditions and grant controls to enforce restrictions, such as device compliance. Simply assigning the policy to a user and cloud apps is not enough to block access from non-compliant or unauthorized devices without those explicit controls.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…

Question

Options

How the community answered

Why each option

Topics

Community Discussion