Microsoft Certified: Identity and Access Administrator AssociateImplement an authentication and access management solutionEasy
A company policy requires that all users accessing the 'Finance App' from unmanaged devices must use a compliant device. The company uses Intune to manage corporate devices and mark them as compliant. Which Azure AD feature, in conjunction with Intune, is used to enforce this access requirement?
- AConditional Access policies
- BAzure AD Application Proxy
- CAzure AD Identity Protection
- DAzure AD Privileged Identity Management (PIM)
Show answer & explanationAnswer & explanation
Correct answer: A. Conditional Access policies
Conditional Access policies are the primary mechanism in Azure AD to enforce access requirements based on various conditions, including device state (e.g., compliant device). When integrated with Intune, Conditional Access can evaluate a device's compliance status and grant or deny access accordingly.
Why the other options are wrong
- B. Application Proxy is for publishing on-premises applications, not for enforcing device compliance.
- C. Identity Protection focuses on risk detection, not directly on device compliance for access control.
- D. PIM is for managing privileged role activation, not for device compliance-based access.
Conditional Access with Device Compliance
Conditional Access policies can be configured to require a device to be marked as 'compliant' by a mobile device management (MDM) solution like Microsoft Intune before granting access to cloud applications. This ensures only trusted and secured devices can access sensitive resources.
- Requires integration with an MDM solution (e.g., Intune).
- The MDM solution determines device compliance.
- Conditional Access evaluates the compliance state during sign-in.
Memory trick: Conditional Access: If device is compliant, then allow.