MD-102 · Question #485
You have a Microsoft 365 E5 subscription. All devices are enrolled in Microsoft Intune. You create a Conditional Access policy named Policy1 that requires multifactor authentication (MFA). You need…
The correct answer is B. Filter for devices under Conditions. To apply a Conditional Access policy requiring MFA exclusively to noncompliant devices, you must configure a device filter under the policy's Conditions section.
Question
You have a Microsoft 365 E5 subscription. All devices are enrolled in Microsoft Intune. You create a Conditional Access policy named Policy1 that requires multifactor authentication (MFA). You need to ensure that Policy1 only applies to devices marked as noncompliant. Which settings of Policy1 should you configure?
Options
- ADevice platforms under Conditions
- BFilter for devices under Conditions
- CTarget resources
- DGrant
- ESession
How the community answered
(66 responses)- A18% (12)
- B68% (45)
- C8% (5)
- D2% (1)
- E5% (3)
Why each option
To apply a Conditional Access policy requiring MFA exclusively to noncompliant devices, you must configure a device filter under the policy's Conditions section.
Device platforms specifies operating systems (e.g., Windows, iOS) but not compliance status.
Conditional Access filters for devices, found under the "Conditions" blade, allow you to dynamically include or exclude devices from a policy based on specific device attributes, such as their compliance status (e.g., `device.isCompliant -eq False`). This enables precise targeting of policies to only noncompliant devices.
Target resources (or Cloud apps or actions) defines which applications the policy protects, not the device's compliance state.
Grant controls the access requirements (e.g., require MFA, require compliant device) if the policy applies, but not which devices the policy applies to based on compliance.
Session controls session-level restrictions after access is granted, such as app enforced restrictions or sign-in frequency.
Concept tested: Conditional Access device filters
Source: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-device-filters
Topics
Community Discussion
No community discussion yet for this question.