Harbor contractors may open a nonproduction Azure subscription only from Intune-compliant laptops, and everyone else must be denied. Which Conditional Access design meets that requirement for Azure cloud resources?
Select an answer to reveal the explanation.
Short Explanation
Think of Conditional Access as the harbor gate: grant means “show your badge and a compliant laptop,” and block means “turn around.” Stack require MFA and require compliant device as grants for the contractors, then block everyone who cannot meet those grants—do not try to fake that with an NSG on their Wi-Fi.
Full Explanation
Conditional Access policies for Azure cloud resources combine conditions with access controls. Grant controls such as require multifactor authentication and require compliant device allow access when requirements are met; the block control denies access when they are not. Network Security Groups filter VM traffic and do not evaluate device compliance for Azure portal or ARM access. Session-only designs without grant or block do not enforce the contractor laptop rule described here.