Contoso needs to control access to Microsoft 365 as follows: (1) SharePoint Online must allow web-only, view-only access from unmanaged devices; (2) Exchange Online must be accessible only from compliant devices; (3) Sign-ins from the corporate egress IP ranges should be exempt from both restrictions. Which design should you implement?

This solution directly addresses all requirements. Creating a named location for corporate egress IPs allows for their exclusion from Conditional Access (CA) policies, fulfilling the exemption requirement. CA Policy A for SharePoint Online, targeting unmanaged devices and using "Use app enforced restrictions," enables view-only web access. CA Policy B for Exchange Online, requiring a compliant device, ensures access only from approved devices. The incorrect options fail to meet specific requirements. The option suggesting a single CA policy for Office 365 with MFA and sign-in frequency doesn't differentiate between SharePoint and Exchange, nor does it enforce compliant devices or web-only access. The option using Conditional Access App Control (monitor only) for SharePoint and blocking legacy authentication for Exchange doesn't enforce the required access restrictions. The option requiring a compliant device for SharePoint and MFA for Exchange, without named locations, doesn't allow for the corporate egress IP exemption or the web-only access for SharePoint.