Grant

When you select Grant, you need to decide whether you're using this policy to block or permit access based on the conditions you're specifying. If you're pairing this with a device compliance policy, this is where you could check the box for Require device to be marked as compliant:

Next, let's look at Session.