What should you configure in the conditional access policy?

You have a Microsoft 365 subscription.

You have a conditional access policy that requires multi-factor authentication (MFA) for users in a group name Sales when the users sign in from a trusted location.

The policy is configured as shown in the exhibit. (Click the Exhibit tab.)

You create a compliance policy.

You need to ensure that the users are authenticated only if they are using a compliant device.

What should you configure in the conditional access policy?
A . a condition
B . a session control
C . a cloud app
D . a grant control

Answer: A

Explanation:

The device state condition can be used to exclude devices that are hybrid Azure AD joined and/or devices marked as compliant with a Microsoft Intune compliance policy from an organization’s Conditional Access policies.

Device state is located on the Condition tab.

Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions#device-state