I'd like to block sign-ins from non-Windows 11 devices. I've tried using the Filter for Devices within a CA policy, configuring it to use "operatingsystemversion starts with 10.0.2" and that works for a moment before the sign-in from a Win 11 device is blocked too. Am I missing something? I'd be grateful for any advice.