2.2MD-102Intermediate
Est: ~15 mins•Verified: 2026-08
Conditional Access: Require Compliant Device
Configure Microsoft Entra Conditional Access policies to restrict Microsoft 365 cloud resources to Intune-compliant managed endpoints.
Tags:#Conditional Access#Compliance#Zero Trust#Entra ID#Security#MD-102
01
Overview
Microsoft Entra Conditional Access (CA) acts as the Zero-Trust policy engine for Microsoft 365. By creating a policy that requires Require device to be marked as compliant, organizations ensure that only endpoints meeting Intune compliance standards can access corporate email, SharePoint, and Teams.
---
02
When to Use
| Scenario | Recommendation | Technical Rationale |
|---|---|---|
| Protect M365 Cloud Apps | Highly Recommended | Blocks unmanaged personal PCs and compromised endpoints from accessing corporate data. |
| Zero Trust Architecture | Mandatory | Replaces perimeter network boundaries with identity and device-health verification. |
---
04
Portal Path
TEXT
Microsoft Entra Admin Center (https://entra.microsoft.com)
└── Protection
└── Conditional Access
└── Policies
└── New Policy---
05
Step-by-Step Implementation
- Users: Include
All users(Exclude Emergency Access / Break-Glass accounts). - Target resources: Select
Cloud apps>All cloud apps(or Office 365). - Conditions: Select
Device platforms> IncludeWindows,macOS,iOS,Android. - Grant Access:
- Select Grant access
- Check Require device to be marked as compliant
- Check Require multifactor authentication
- Select Require all the selected controls
- Enable Policy: Set to
Report-only(test mode for 7 days) before moving toOn.
---
12
MD-102 Exam Notes
Exam Blueprint & High-Yield Traps
Key Exam Rules:
- Always configure a Break-Glass Emergency Account excluded from Conditional Access to prevent total tenant lockout.
- Conditional Access evaluates compliance signals delivered by Microsoft Intune.