How Do You Scope a Conditional Access Policy to Only Noncompliant Devices?
You have a Microsoft 365 E5 subscription. All devices are enrolled in Microsoft Intune. You create a Conditional Access policy named Policy1 that requires multifactor authentication (MFA). You need to ensure that Policy1 only applies to devices marked as noncompliant. Which settings of Policy1 should you configure?
Community Votes
73% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the difference between targeting a policy (conditions/filters decide who and what the policy applies to) and enforcing a requirement (Grant decides what the user must satisfy) — the trap is reaching for Grant because the word 'compliant' appears there.
In Microsoft Intune with Entra ID Conditional Access, scoping a policy such as Policy1 so it applies only to devices marked noncompliant is done with a device filter under Conditions, not with the Grant controls. This page confirms that the correct setting is Filter for devices under Conditions using the IsCompliant property.
Choosing Grant and selecting 'Require device to be marked as compliant', which does not limit the policy to noncompliant devices — it blocks or challenges every device that fails the compliance check, including the compliant ones the policy was never meant to touch.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Policy1 already contains its authentication requirement: it requires MFA. The remaining task is purely about scope — making the policy apply only when a device is flagged as noncompliant. In Entra ID Conditional Access, scope is expressed through Assignments, and the Assignments section offers Conditions > Filter for devices, where you build a rule on device properties such as device.isCompliant (shown in the portal as IsCompliant) with the operator Equals and value No. That rule limits evaluation of the policy to noncompliant devices only, while MFA itself stays in the Grant controls. As chafe put it, the path is "Conditional Access -> Conditions -> Filter for devices -> Property: IsCompliant". This is exactly why option B is the setting to configure and why community voters overwhelmingly landed on it.Why the Other Options Are Wrong
Grant (D) defines what the user must satisfy to get access — for example, "Require multifactor authentication" or "Require device to be marked as compliant" — so it cannot restrict which devices the policy evaluates. Selecting 'Require device to be marked as compliant' in Grant would simply block noncompliant devices rather than scope the policy to them; as one commenter observed, "Grant can't be used because the question is asking to apply the policy only on devices marked as Noncompliant". Target resources (C) selects which cloud apps or user actions the policy protects, Device platforms (A) filters by operating system, and Session (E) controls sign-in frequency, app-enforced restrictions, and similar session behaviours — none of them can express 'device is noncompliant'.Community Comment Notes
Consensus in the comments strongly supports the filter approach: EliseM described the navigation as "Devices --> Conditional access --> Policies --> New policy --> Conditions --> Filter for devices", and RFULL reasoned that applying a policy only to noncompliant devices "would require a device filter rule". oopspruu made the sharpest point — the objective is scoping, not MFA, so a condition-level filter is the only setting that isolates noncompliant devices. A minority led by ronniefactor insisted that Grant is correct because it "worked" in their tenant, but a Grant control that prompts or blocks noncompliant devices is a different behaviour from scoping a policy to them, so those votes do not change the answer.Official Reference
Exam Strategy
When a Conditional Access question says a policy must 'only apply to' a population, think Assignments first — users, groups, target resources, conditions, and device filters — and treat Grant and Session as answers to 'what must the user do' rather than 'who does this apply to'. Remember that device.isCompliant is a filter property usable with Equals/NotEquals against true or false.
Frequently Asked Questions
Why can't I use Grant with 'Require device to be marked as compliant' to target noncompliant devices?
Grant controls state what a user must satisfy to gain access; they do not limit which devices the policy evaluates. Setting that Grant control blocks or challenges noncompliant devices instead of scoping the policy to them.
Which property and operator do I use in the device filter for noncompliant devices?
Use the IsCompliant property with the operator Equals and the value No (or NotEquals/Yes), configured under Conditions > Filter for devices in the Conditional Access policy.
Related Analysis
Practice All MD-102 Questions
Access 92 questions with complete answers and detailed explanations.
View Full MD-102 Practice Test →