Question

Contoso wants to ensure that administrators can only perform actions in the Microsoft Entra admin center from corporate-owned devices marked as compliant. Some administrators also carry personal laptops that are Entra registered but not compliant. You must build a single Conditional Access policy that blocks access to admin portals unless the sign-in comes from a compliant device, and this restriction should apply only when users are actively using a privileged directory role. Which combination of policy assignments and conditions should you configure?

Accepted Answer

Assign the policy to the directory roles (such as Global Administrator and Security Administrator), target the Microsoft Admin Portals cloud app, and grant access requiring device to be marked as compliant.

Answer

Assign the policy to all users, target the Microsoft Admin Portals cloud app, use a device filter that includes devices where trustType equals 'ServerAD', and grant access requiring compliant device.

Answer

Assign the policy to all guest and external users, target all cloud apps, add a sign-in risk condition of medium and above, and grant access requiring MFA.

Answer

Assign the policy to all users, target all cloud apps, use an authentication context, and grant access requiring a Hybrid Entra joined device.