Conditional Access Policies not working as intended/expected

What I try to achieve: If $user signs in to office.com from their private/shared computer/tablet they should be logged out as soon as they close their browser to ensure nobody else can just re-open the browser and get into the session.

To achieve that, we deployed the following CAP:

This seems to do what we wanted.

But sadly, it also does more, which we do not want: It signs off users in their active browser. So if someone uses e.g. outlook.office.com they will be signed out after a very random amount of time.

So how do we get users signed off on closing the browser but keep them signed in UNTIL they close the browser?