SC-100 Certification Practice Question #137

Question

You have an Azure subscription and a Microsoft 365 subscription. All users are assigned Microsoft 365 E5 licenses. All computers run Windows 11 and are Microsoft Entra joined.

You need to recommend a solution to prevent computers that run early builds of Windows 11 from connecting to Microsoft 365 services.

Which two types of policies should you include in the recommendation? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Accepted Answer

This is a two-part "choose two" answer where one policy defines device posture and the other enforces it. Microsoft Intune compliance policy supplies the **Minimum OS version** device-property rule that marks devices on early Windows 11 builds as noncompliant; Microsoft Entra Conditional Access then enforces a "Require device to be compliant" grant control to block those devices from Microsoft 365. MS Learn states this pairing verbatim — Intune defines the minimum OS version and Conditional Access blocks noncompliant devices. The official Suggested Answer only lists E (the enforcement half), which alone cannot detect the build, so the community correctly supplements it with C; the Most Voted CE has unanimous agreement across three commenters with MS Learn backing. Confidence is held at 88 rather than higher because the printed Suggested Answer is the single letter E, creating a documented partial-vs-community mismatch, though MS Learn clearly resolves it in favor of CE. The lone A dissent does not address OS-version gating and is discounted.

More SC-100 practice questions