Question

A financial services company is adopting the Zero Trust model and wants to strengthen the 'endpoints' pillar. Employees use a mix of corporate-managed Windows laptops and unmanaged personal devices to access a sensitive SaaS finance application through Microsoft Entra ID. Security leadership requires that only devices proven healthy and compliant at the moment of sign-in can reach the application, while unmanaged devices should be limited to browser-only access with no download capability. Which design best aligns with Zero Trust principles for verifying device signals explicitly?

Accepted Answer

Configure a Conditional Access policy that requires devices to be marked compliant by Microsoft Intune, and apply Entra ID app-enforced restrictions to allow limited browser-only sessions for non-compliant devices

Answer

Join all personal devices to the corporate network via VPN and rely on network location as the trust boundary for the finance application

Answer

Require multifactor authentication for all users and treat any successful MFA as sufficient proof of device health

Answer

Deploy the finance application behind an on-premises firewall and grant access only from IP addresses within the corporate range