The device is part of the request, not just the network path
Conditional access evaluates more than the credential presented — it factors in properties of the device making the request: whether it's enrolled in management, whether its operating system is current, whether disk encryption is active, whether it shows signs of known compromise. The same valid login from a fully patched, managed device and from an unknown, unmanaged one can reasonably receive different treatment.
This closes a specific gap that credential-only checks leave open: a stolen password used from an attacker's own unmanaged device still presents valid credentials. Factoring in device posture gives the system another signal to weigh, even when the credential itself checks out.
Posture is a snapshot, and snapshots go stale
A device that passes every posture check at login can still be compromised moments later — posture is evaluated at a point in time, not continuously guaranteed for the life of a session. Systems that re-evaluate posture periodically, or step up requirements when posture data goes stale, close more of that gap than a system that checks once at the start and never again.