Two applicable Conditional Access policies require MFA and a compliant device respectively. What must a successful sign-in normally satisfy?

1. Neither policy if the user prefers a password
2. The applicable controls from both policies
3. Only the least restrictive policy
4. Only the policy created most recently