Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft 365 Certified: Endpoint Administrator Associate · Microsoft
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
User1 can access Site1 from Device1 → No. The CA policy targets Group1 and blocks access. The device filter excludes devices whose name starts with “Device”, but Device1 isn’t registered/joined (Azure AD join type None), so it doesn’t match the filter and the block applies. “Not registered/joined” = the device has no Microsoft Entra ID (Azure AD) device identity. Any CA settings that rely on device state (e.g., Require device to be marked as compliant, Require Hybrid Azure AD joined, or device filters) won’t match—the sign-in is evaluated as coming from an unknown device. User2 can access Site1 from Device2 → Yes. Device2 is Azure AD joined and its name starts with Device, so it’s excluded from the policy and access is allowed. User2 can access Site1 from Device3 → Yes. Device3 is Azure AD registered and its name starts with Device, so it’s also excluded and access is allowed.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Yes Yes Yes why ? Filter for devices → Exclude devices where: device.displayName -startsWith "Device" so all devices are excluded from CA. It does not matter if the device is in joined/registered or none state. it filters on diplayname it only matters if you use other filters like device.deviceOwnership or device.Trusttype Yes Yes Yes why ? Filter for devices → Exclude devices where: device.displayName -startsWith "Device" so all devices are excluded from CA. It does not matter if the device is in joined/registered or none state. it filters on diplayname it only matters if you use other filters like device.deviceOwnership or device.Trusttype
User1 can access Site1 from Device1 → No. The CA policy targets Group1 and blocks access. The device filter excludes devices whose name starts with “Device”, but Device1 isn’t registered/joined (Azure AD join type None), so it doesn’t match the filter and the block applies. “Not registered/joined” = the device has no Microsoft Entra ID (Azure AD) device identity. Any CA settings that rely on device state (e.g., Require device to be marked as compliant, Require Hybrid Azure AD joined, or device filters) won’t match—the sign-in is evaluated as coming from an unknown device. User2 can access Site1 from Device2 → Yes. Device2 is Azure AD joined and its name starts with Device, so it’s excluded from the policy and access is allowed. User2 can access Site1 from Device3 → Yes. Device3 is Azure AD registered and its name starts with Device, so it’s also excluded and access is allowed.
Access Evaluation: User1 can access Site1 from Device1 User1 is in Group1 Device1 is not Azure AD joined, thus not excluded → Blocked ✅ Answer: No User2 can access Site1 from Device2 User2 is in Group1 Device2 is Azure AD joined and matches exclusion filter → Allowed ✅ Answer: Yes User2 can access Site1 from Device3 Device3 is Registered (not joined), not excluded User2 is in Group1 → Blocked by policy ✅ Answer: No ✅ Final Answers: User1 can access Site1 from Device1 → No User2 can access Site1 from Device2 → Yes User2 can access Site1 from Device3 → No ______________________________________________