You can restrict access for devices that haven't been marked as compliant via Intune. You will need an Azure AD Premium subscription to configure the restrictions here. Conditional access policies are outside the scope of the MS-300 exam, but it is important to know that the settings in SharePoint or Teams for compliant device access can be combined with features in Intune.
For more information about Intune and Conditional Access policies, please see https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview.
The available options are as follows:
- Allow full access from desktop apps, mobile apps, and the web
- Allow limited, web-only access
- Block access
Selecting the option for Allow limited, web-only access or Block access will change the setting for Apps that don't use modern authentication to Block since modern authentication is required to enforce device-level policies.