MS-102 Exam - Question 83

Question

HOTSPOT -You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1 and the users shown in the following table. The devices are configured as shown in the following table. You have a Conditional Access policy named CAPolicy1 that has the following settings:Assignments -Users or workload identities: Group1Cloud apps or actions: Office 365 SharePoint OnlineConditions -Filter for devices: Exclude filtered devices from the policyRule syntax: device. displayName -startsWith "Device"Access controls -Grant -Grant: Block access -Session: 0 controls selected -Enable policy: On -For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Examice · Accepted Answer

.

amurp35 · Answer

read the policy like this: "exclude from the block if the device starts with "device"". The first device is not registered. It is not, therefore, excluded from the block as it is not analyzed. It is blocked. The next two devices, however, are excluded from the block. N/Y/Y

692a0df · Answer

Y/Y/Y for me...
First one:  my reading on this - as the device is not registered in Azure AD then the CAP does not apply.  Then it's down to the Global settings (Sharepoint Admin -> Policies -> Access Control -> Unmanaged Device) for unmanaged devices (see link) which by default is set to 'Allow full access'.
https://learn.microsoft.com/en-US/sharepoint/control-access-from-unmanaged-devices?WT.mc_id=365AdminCSH_spo

hogehogehoge · Answer

This answer is correct. Device1 is not registerd in Azure AD. In this case, Device filter is not enable. So Device1 is blocked.

daye · Answer

but... a non Azure AD device cannot be applied by a Conditional Access, therefore it won't validate it, so it won't be blocked. In other words, it's a cloud solution for a non cloud identity device. Am I missing something?

Moazzamfarooqiiii · Answer

All the devices are called Device so there is a filter to exclude device. They all have device name So does that not mean YYY

Khanbaba43 · Answer

User1: Is not excluded from the block, so the block stays, hence can't access Site1.
User2 & User3: Are excluded from the block, so no block applied, hence they can access Site1.
My answer: NYY

Khanbaba43 · Answer

Exlude filtered devices. 
1. Device 1 not filtered and is not excluded from the block, hence blocked and CANNOT access the site.
2. Dev 2 & 3 are filtered and are excluded from the block, hence not blocked and CAN access the site.

EubertT · Answer

Access Evaluation:
User1 can access Site1 from Device1

User1 is in Group1

Device1 is not Azure AD joined, thus not excluded → Blocked

✅ Answer: No

User2 can access Site1 from Device2

User2 is in Group1

Device2 is Azure AD joined and matches exclusion filter → Allowed

✅ Answer: Yes

User2 can access Site1 from Device3

Device3 is Registered (not joined), not excluded

User2 is in Group1 → Blocked by policy

✅ Answer: No

✅ Final Answers:
User1 can access Site1 from Device1 → No

User2 can access Site1 from Device2 → Yes

User2 can access Site1 from Device3 → No

______________________________________________

MS-102 Exam - Question 83

Discussion