https://d365hub.com/posts/details/dca2ab30-809e-408c-9224-16a84b297bb6/scoping-conditional-access-policies-to-tagged-applications