🏷 How you to secure data in Microsoft 365 with Sensitivity Labels

Hello Giuliano,
W've a label to secure Sites and Groups with MFA. The conditional access policy is assigned to a group of users. Implementation of the label is based on a mandatory user action: apply label to site/ group.. Sign in frequency 4 hours.. The label is assigned to only one user.
- For now this label is implemented to one site.
- Visiting that site prompts a MFA dialog for users in the group included in the CA
- all other sites are accessible without MFA using a browser
So far OK.
If one of these users tries to open a cloud document located somewhere in M365 using a M365 client app it triggers also the MFA prompt! Accessing the same document via a browser doesn't...
Any thoughts/ solutions how to avoid such prompts when using client apps?