Conditional Access and Compliance Policies Flashcards

What is the first thing Intune evaluates when a device checks in for compliance assessment?

Answer: Whether any compliance policies are assigned to the device or user

Intune first checks if any compliance policies are assigned; devices with no compliance policy are considered compliant by default unless the tenant setting is changed.

Which Azure AD feature integrates with Intune compliance status to block non-compliant devices from accessing corporate resources?

Answer: Conditional Access requiring a compliant device

Conditional Access can require 'device marked as compliant' as a grant control, blocking access to apps until the device meets Intune compliance requirements.

An Intune compliance policy sets minimum OS version to Windows 10 21H2. A device running 21H1 is enrolled. What is the device's compliance state?

Answer: Not compliant

A device running an OS version lower than the required minimum is immediately marked Not compliant by the Intune compliance policy.

What does the Intune compliance policy 'grace period' setting control?

Answer: The number of days a non-compliant device retains access before Conditional Access blocks it

The grace period gives users a defined number of days to remediate non-compliance before Conditional Access enforces the block, preventing immediate access disruption.

Which compliance policy action sends an automatic notification email to users when their device becomes non-compliant?

Answer: Send email to end user — under Actions for noncompliance

The 'Send email to end user' action in compliance policy Actions for noncompliance automatically notifies users with configurable message templates.

A Conditional Access policy requires MFA for all users accessing Exchange Online. A user with a compliant Intune device still gets prompted for MFA. What is the likely cause?

Answer: The Conditional Access policy requires both MFA and compliant device — both controls must be satisfied

When Conditional Access requires multiple grant controls with 'Require all selected controls', users must satisfy all requirements including MFA even if device is compliant.