nerdexam
Microsoft

MD-102 · Question #485

You have a Microsoft 365 E5 subscription. All devices are enrolled in Microsoft Intune. You create a Conditional Access policy named Policy1 that requires multifactor authentication (MFA). You need…

The correct answer is B. Filter for devices under Conditions. To apply a Conditional Access policy requiring MFA exclusively to noncompliant devices, you must configure a device filter under the policy's Conditions section.

Submitted by andres_qro· Apr 18, 2026Protect devices

Question

You have a Microsoft 365 E5 subscription. All devices are enrolled in Microsoft Intune. You create a Conditional Access policy named Policy1 that requires multifactor authentication (MFA). You need to ensure that Policy1 only applies to devices marked as noncompliant. Which settings of Policy1 should you configure?

Options

  • ADevice platforms under Conditions
  • BFilter for devices under Conditions
  • CTarget resources
  • DGrant
  • ESession

How the community answered

(66 responses)
  • A
    18% (12)
  • B
    68% (45)
  • C
    8% (5)
  • D
    2% (1)
  • E
    5% (3)

Why each option

To apply a Conditional Access policy requiring MFA exclusively to noncompliant devices, you must configure a device filter under the policy's Conditions section.

ADevice platforms under Conditions

Device platforms specifies operating systems (e.g., Windows, iOS) but not compliance status.

BFilter for devices under ConditionsCorrect

Conditional Access filters for devices, found under the "Conditions" blade, allow you to dynamically include or exclude devices from a policy based on specific device attributes, such as their compliance status (e.g., `device.isCompliant -eq False`). This enables precise targeting of policies to only noncompliant devices.

CTarget resources

Target resources (or Cloud apps or actions) defines which applications the policy protects, not the device's compliance state.

DGrant

Grant controls the access requirements (e.g., require MFA, require compliant device) if the policy applies, but not which devices the policy applies to based on compliance.

ESession

Session controls session-level restrictions after access is granted, such as app enforced restrictions or sign-in frequency.

Concept tested: Conditional Access device filters

Source: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-device-filters

Topics

#Conditional Access#Device Compliance#MFA#Entra ID

Community Discussion

No community discussion yet for this question.

Full MD-102 Practice