Entra Conditional Access Policy not blocking log ins from mobile devices

Hi there.

I've pasted the details below.

I have one user in the 'include' and one user in the 'exclude' to test - we can both access it.

I did revoke sign-in sessions for myself, and was forced to log in everywhere again - but not the powerapps apps on my phone. I'm assuming there is some persistent token on my phone that allows me to stay logged in?

Thanks :)
Amber