LESSON 3 OF 4
Exercise: compliant but access denied
Change the evidence
Resolve a conflict narrowly
LAB-C needs the actual setting and competing assignments. Compare desired values and ownership rather than disabling every security configuration.
Separate compliance and access
LAB-A is compliant and allowed in the fixture, but those facts do not prove that every application permits it. Resource policy, user assignment and authentication remain separate layers.
Design a pilot
Choose representative platforms, a delivery deadline, known-good baseline and rollback owner. Capture the setting on the endpoint and management reports where available before wider release.
Diagnose failures
Pending is treated as conflict
Check delivery, connectivity and freshness first.
Compliant device gets 403
Investigate the actual access decision and application permissions.
One platform fails all settings
Review platform support and enrollment prerequisites before changing every policy.
A second worked example
Device: LAB-14; enrollment: present
Assigned configuration: encryption requirement
Last check-in: before policy assignment
Compliance: encryption not evidenced
Next check: updated policy delivery and evaluated statusThe stale check-in means you cannot assume the new configuration was delivered. Inspect current assignment and the device’s next authorized check-in/result. Then evaluate whether the requirement is met and why compliance reports its state. Do not simply mark the device compliant or weaken access policy to hide the issue.
Transfer exercise
A policy targets a group but the device is excluded by a filter. What should you record?
Worked transfer answer
Record the effective targeting decision, relevant group/filter details and whether the exclusion is intended. If the assignment is wrong, correct the approved targeting configuration. Do not infer a client failure when the device is outside effective scope.
Exercise: compliant but access denied
Device A is compliant, yet a user cannot open a business app. What evidence is still missing?
Worked reasoning
Compliance is one input, not universal permission. Collect the user, tenant, target app, time, applicable access-policy evaluation and app entitlement. Confirm the sign-in actually carries the intended device context. Do not weaken the compliance policy simply because an unrelated authorization layer may have denied access.
Worked laboratory solution
Compare your reasoning with the worked solution
D1 has the stated end-to-end evidence for that tested moment. D2 needs a current check-in/evaluation and access test; enrollment alone is insufficient. D3 is an assignment-scope issue, not necessarily a failed policy setting. D4’s older compliance result does not establish current connectivity or access; separate the transport failure from compliance interpretation. Report unknown and not-in-scope distinctly. Do not mark every non-success as noncompliant or widen assignment to all devices just to make a dashboard look complete.
YOUR NEXT STEP
Keep building your skills
No directly related CogniSkill book is mapped to this course yet. Continue with the free learning, or compare the publishing catalogue by your next goal.
Explore books by topic and goal →Sign in to save lesson completion. Reading position is separate from completion.
Practice notes — your working space
Save predictions, outputs and explanations as you work. Notes stay on this browser, not your account; people sharing this browser can access them. Avoid passwords and sensitive data. Export to keep a portable copy, or clear your notes before leaving a shared device.
How was this lesson?
Help us improve this lesson.