Conditional Access - Required Device to be Compliant

I have created a conditional access policy to only allow access to an application (Zendesk) where we use Azure AD Single Sign-on.  The policy does work if I select MFA or if I exclude my trusted IPs....