CA policy for corporate devices

Hello Ahmed,

1-  You can check the issue by going to Entra ID, selecting which user is a member of the group, and checking if the login failed due to Conditional Access. In the sign-in logs, Microsoft provides all the data, including the reasons for both successful and failed sign-in

2-  Based on what you described, it seems like you might have overlooked something here. 

Under the condition where you selected **Device - Windows**, there’s an option called **Client Apps**. In that section, you can check if browsers are also blocked, similar to what is shown in the screenshot.

2- In the filter, which options did you use: include or exclude? Did you mind if you provide me with the query?

Let me know if this resolves the issue