Exam MS-101 topic 1 question 32 discussion

Device1 is compliant: No, because Device 1 is member of group 3 so policy 1 is assigned. Policy 1 requires Bitlocker encryption which device 1 does not have thus is Device 1 marked as non compliant Device2 is compliant: No, because Device 2 is member of group 2 and 3, Device 2 is marked as non compliant by the same reason as Device 1. Device3 is compliant: Yes, Device 3 is member of group 2, Policy 2 applies to Group 2, the policy does not require Bitlocker encryption, thus the device is compliant

NO (policy1) NO (policy1 applied by priority - higher) YES (policy2)

Valid in 16 Sep 22

There we go: https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot#if-multiple-policies-are-assigned-to-the-same-user-or-device-how-do-i-know-which-settings-gets-applied When two or more policies are assigned to the same user or device, then the setting that's applied happens at the individual setting level: • Compliance policy settings always have precedence over configuration profile settings. • If a compliance policy evaluates against the same setting in another compliance policy, then the most restrictive compliance policy setting applies. • If a configuration policy setting conflicts with a setting in another configuration policy, this conflict is shown in Intune. Manually resolve these conflicts. Thanks for the link " kiketxu "

So only the most secure policy is chosen ? referring to Device 2

Policy 3 is not assigned so why is device 2 not complaint.

NO-NO-YES or YES-YES-YES ?

How is device 2 not compliant if it is in group 2 that is "Assigned" but not requiring bitlocker?