Exam MD-102 topic 1 question 281 discussion

Conditional Access -> Conditions -> Filter for devices -> Property: IsCompliant

Grant can't be used because the question is asking to apply the policy only on devices marked as Noncompliant. With "Grant" option you can select "Require device to be marked as compliant" (Device must be Intune compliant. If the device is non-compliant, the user will be prompted to bring the device under compliance.), which means if the devices is noncompliant, then the policy will not be applied on it. While with Filter for devices, you can select "Exclude filtered devices from policy" and choose "isCompliant" in the filter. This will apply the policy on all the devices apart from the filtered ones which is the Compliant devices.

D is the correct answer: I tested it on my tenant, Grant - require device to be marked as complaint option

Devices --> Conditional access --> Policies --> New policy --> Conditions --> Filter for devices.

The objective is to ensure policy only applies to noncompliamt devices. It has nothing to do with mfa. B ensures it only applies to non compliant devices.

B seems correct

B: To apply the policy to only non-compliant devices would require a device filter rule. Grant would apply to compliant devices. But would also require MFA if the device was not compliant.

D is correct

Correct.