How Do You Scope a Conditional Access Policy to Only Noncompliant Devices?

MD-102 By islever Editorial Last updated

Short answer

B Configure Filter for devices under Conditions with an IsCompliant filter set to No so Policy1 applies only to noncompliant devices.

Question

You have a Microsoft 365 E5 subscription. All devices are enrolled in Microsoft Intune. You create a Conditional Access policy named Policy1 that requires multifactor authentication (MFA). You need to ensure that Policy1 only applies to devices marked as noncompliant. Which settings of Policy1 should you configure?
  1. Device platforms under Conditions
  2. Filter for devices under Conditions Correct Answer
  3. Target resources
  4. Grant
  5. Session

Key Takeaways

The question tests the difference between targeting a policy (conditions/filters decide who and what the policy applies to) and enforcing a requirement (Grant decides what the user must satisfy) — the trap is reaching for Grant because the word 'compliant' appears there.

In Microsoft Intune with Entra ID Conditional Access, scoping a policy such as Policy1 so it applies only to devices marked noncompliant is done with a device filter under Conditions, not with the Grant controls. This page confirms that the correct setting is Filter for devices under Conditions using the IsCompliant property.

Common mistake: Choosing Grant and selecting 'Require device to be marked as compliant', which does not limit the policy to noncompliant devices — it blocks or challenges every device that fails the compliance check, including the compliant ones the policy was never meant to touch.

Expert Analysis

Why the Answer Is Correct

Policy1 already contains its authentication requirement: it requires MFA. The remaining task is purely about scope — making the policy apply only when a device is flagged as noncompliant. In Entra ID Conditional Access, scope is expressed through Assignments, and the Assignments section offers Conditions > Filter for devices, where you build a rule on device properties such as device.isCompliant (shown in the portal as IsCompliant) with the operator Equals and value No. That rule limits evaluation of the policy to noncompliant devices only, while MFA itself stays in the Grant controls. As chafe put it, the path is "Conditional Access -> Conditions -> Filter for devices -> Property: IsCompliant". This is exactly why option B is the setting to configure and why community voters overwhelmingly landed on it.

Why the Other Options Are Wrong

Grant (D) defines what the user must satisfy to get access — for example, "Require multifactor authentication" or "Require device to be marked as compliant" — so it cannot restrict which devices the policy evaluates. Selecting 'Require device to be marked as compliant' in Grant would simply block noncompliant devices rather than scope the policy to them; as one commenter observed, "Grant can't be used because the question is asking to apply the policy only on devices marked as Noncompliant". Target resources (C) selects which cloud apps or user actions the policy protects, Device platforms (A) filters by operating system, and Session (E) controls sign-in frequency, app-enforced restrictions, and similar session behaviours — none of them can express 'device is noncompliant'.

Community Comment Notes

Consensus in the comments strongly supports the filter approach: EliseM described the navigation as "Devices --> Conditional access --> Policies --> New policy --> Conditions --> Filter for devices", and RFULL reasoned that applying a policy only to noncompliant devices "would require a device filter rule". oopspruu made the sharpest point — the objective is scoping, not MFA, so a condition-level filter is the only setting that isolates noncompliant devices. A minority led by ronniefactor insisted that Grant is correct because it "worked" in their tenant, but a Grant control that prompts or blocks noncompliant devices is a different behaviour from scoping a policy to them, so those votes do not change the answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a Conditional Access question says a policy must 'only apply to' a population, think Assignments first — users, groups, target resources, conditions, and device filters — and treat Grant and Session as answers to 'what must the user do' rather than 'who does this apply to'. Remember that device.isCompliant is a filter property usable with Equals/NotEquals against true or false.

Frequently Asked Questions

Why can't I use Grant with 'Require device to be marked as compliant' to target noncompliant devices?

Grant controls state what a user must satisfy to gain access; they do not limit which devices the policy evaluates. Setting that Grant control blocks or challenges noncompliant devices instead of scoping the policy to them.

Which property and operator do I use in the device filter for noncompliant devices?

Use the IsCompliant property with the operator Equals and the value No (or NotEquals/Yes), configured under Conditions > Filter for devices in the Conditional Access policy.

More MD-102 FAQ →

Community Votes

B
73%
D
27%

73% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. chafe 👍 5 Answered B
    Conditional Access -> Conditions -> Filter for devices -> Property: IsCompliant
  2. EliseM 👍 4 Answered B
    Devices --> Conditional access --> Policies --> New policy --> Conditions --> Filter for devices.
  3. RFULL 👍 3 Answered B
    B: To apply the policy to only non-compliant devices would require a device filter rule. Grant would apply to compliant devices. But would also require MFA if the device was not compliant.
  4. oopspruu 👍 2 Answered B
    The objective is to ensure policy only applies to noncompliamt devices. It has nothing to do with mfa. B ensures it only applies to non compliant devices.
  5. ronniefactor 👍 2 Answered D
    D is the correct answer: I tested it on my tenant, Grant - require device to be marked as complaint option
Show 4 more comments
  1. Knight_Of_Peace 👍 1
    Grant can't be used because the question is asking to apply the policy only on devices marked as Noncompliant. With "Grant" option you can select "Require device to be marked as compliant" (Device must be Intune compliant. If the device is non-compliant, the user will be prompted to bring the device under compliance.), which means if the devices is noncompliant, then the policy will not be applied on it. While with Filter for devices, you can select "Exclude filtered devices from policy" and choose "isCompliant" in the filter. This will apply the policy on all the devices apart from the filtered ones which is the Compliant devices.
  2. ergacharsk 👍 2 Answered B
    B seems correct
  3. jackyss 👍 2 Answered D
    D is correct
  4. jdr002 👍 2 Answered D
    Correct.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide