A public library system wants housing case SharePoint sites reachable only from devices that meet compliance requirements. Which control's purpose fits?

Conditional Access policies can require compliant devices before Microsoft 365 grants access to resources. For a public library system protecting housing-case SharePoint sites, that purpose fits: evaluate device compliance (and related conditions) and allow or block access accordingly so sensitive case materials are not opened from arbitrary unmanaged devices. Conditional Access is the control whose purpose matches compliant-device gating.

Intune compliance policies that evaluate device health and record compliance status for reporting fail by concept because they assess and report device health rather than gating SharePoint access based on compliance. SharePoint site sharing settings that manage guest invitation levels for site content fail because guest-sharing controls do not evaluate device compliance before granting access to housing-case materials. Sensitivity labels that classify case files and enforce encryption for shared documents fail because labeling and encryption protect content, not device-compliance-based access to the site.

Exam caveat: AB-900 tests Conditional Access purpose—adaptive access based on conditions such as device compliance—not building every grant control in a lab. Intune compliance policies often feed the compliant-device signal, but the exam focus here is why Conditional Access is the right control family. Do not confuse guest-sharing settings or sensitivity labeling with access gating.

Operational check: Place a housing-case site behind Conditional Access requiring compliant devices, test access from a known-compliant municipal device (allowed) and a non-compliant or unmanaged device (blocked or limited per policy). Confirm Intune compliance policies, SharePoint site sharing settings, and sensitivity labels were not used as substitutes for the device gate.