Microsoft 365 Administrator Expert MS-102 Practice Question

To enforce device compliance or hybrid Azure AD join only when the connection originates outside the company's trusted ranges, the policy must apply to every location except those trusted ranges. The correct approach is to include All locations and then explicitly exclude the Trusted named locations. Under Grant controls, Require device to be marked as compliant OR Require hybrid Azure AD joined device enforces the device state when the policy is applied. Selecting only the trusted locations, blocking access, or requiring a password change would either ignore untrusted networks or impose the wrong control, so those options do not satisfy the scenario.