You manage a line-of-business app protected by Azure AD. Requirements: allow access only from devices marked as compliant when users are outside trusted corporate networks; block access when sign-in risk is High. You maintain an egress IP list for corporate offices and VPN. Which two configurations should you implement?

The first correct option addresses the requirement to allow access only from compliant devices when users are outside trusted networks. By defining trusted named locations for corporate IPs, a Conditional Access policy can then target "Any location excluding trusted named locations" and enforce the "Require device to be marked as compliant" control. This ensures that users accessing from untrusted locations must use a compliant device. The second correct option directly fulfills the requirement to block access when sign-in risk is High by creating a Conditional Access policy that targets this specific risk level. The incorrect option "Enable per-user MFA for all users..." does not address the device compliance or sign-in risk requirements. The incorrect option "Configure a location restriction in the app’s manifest..." is not an Azure AD Conditional Access feature and would not provide the necessary device compliance or risk-based access controls.