You created a Conditional Access policy (Policy1) that requires MFA. You want Policy1 to apply only to devices marked noncompliant. Which part of Policy1 should you configure to achieve this?

To apply a Conditional Access policy only to non-compliant devices, you configure the "Filter for devices" under the "Conditions" section. This allows you to define a filter rule, such as device.isCompliant -eq False, which targets devices based on their compliance status. "Device platforms" under Conditions would restrict the policy to specific operating systems (e.g., iOS, Android), not compliance status. "Target resources" specifies the cloud apps or actions the policy applies to. "Grant" defines the access controls required (e.g., MFA, compliant device). "Session" controls session-specific actions after access is granted (e.g., app enforced restrictions).