Question 760
An administrator needs to see which Conditional Access rule denied a mobile sign-in under MAM controls. Which configuration BEST meets this requirement?
Explanation
Correct Answer
Sign-in logs connect authentication attempts with policy grant outcomes. It directly addresses diagnosed mobile app protection grant.
Incorrect Answers
App-protection grant evaluates protected client app context during sign-in. That suits MAM-gated mobile authentication, whereas this device needs diagnosed mobile app protection grant.
Device compliance grant uses MDM-evaluated endpoint posture. The choice addresses managed Windows compliance access rather than diagnosed mobile app protection grant.
App-based access grants need compatible client apps. It solves supported protected mobile client; the actual goal is diagnosed mobile app protection grant.






Endpoint Administrator (MD-102) Practice Tests