You need to enforce that only devices that are either compliant (Intune) or hybrid Azure AD joined can access Exchange Online. Additionally, sign-ins assessed as High risk must be blocked. What should you configure? (Choose two)

The first correct option addresses the device compliance requirement. A Conditional Access policy targeting Exchange Online with grant controls "Require device to be marked as compliant" OR "Require hybrid Azure AD joined" ensures that only compliant or hybrid Azure AD joined devices can access Exchange Online. The "Require one of the selected controls" option is crucial for the OR logic. The second correct option handles the high sign-in risk. A separate Conditional Access policy is needed to block high-risk sign-ins, as this is a distinct security requirement from device compliance. Combining it with the device policy could lead to unintended outcomes or make policy management complex. The incorrect option "In the same Conditional Access policy, set the Sign-in risk condition to Medium or above and require a password change" is wrong because the requirement is to block high-risk sign-ins, not just require a password change, and combining it with the device policy is not ideal. "Enable app-enforced restrictions for Exchange Online" is not the primary mechanism for enforcing device compliance or hybrid Azure AD join for access. "Rely on an Intune device compliance policy with the setting Require domain join only; Conditional Access is not needed" is incorrect because Conditional Access is essential to enforce the compliance policy for access to Exchange Online.