SC-300 Certification Practice Question #175

Question

Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains 500 Windows 11 devices.

You have a Microsoft 365 subscription that syncs with the domain.

You create a Conditional Access policy named Policy1.

You need to meet the following requirements:

•	Apply Policy1 to all the Windows devices.
•	Assess the compliance of the Windows devices with Policy1.

What should you do for each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The 500 Windows 11 devices are already domain-joined to on-premises AD DS and the tenant syncs with that domain, so the correct way to surface them in Microsoft Entra ID (so Conditional Access can target them) is Microsoft Entra hybrid join — the documented option for organizations still managing PCs through AD group policy. To "assess the compliance" of those devices for a Conditional Access grant control, the devices must report a compliance state, which only Microsoft Intune device compliance policies produce; Conditional Access then reads that Intune compliance signal. Defender for Endpoint and Purview do not generate the CA compliance verdict. MS Learn supports both selections; confidence is 88 (not higher) because the discussion carries no Suggested Answer or community vote to corroborate, though the documentation maps each row cleanly.

More SC-300 practice questions