Conditional Exchange Access

Hi all

I recently configured Conditional Exchange Access (CEA) for a company but when I applied the Access Policy, it applied to all devices in the company not just mobile phones as was originally intended.

Users were blocked on their desktops, Surfaces everything. I quickly deleted the access policy.

How do I limit the scope of the access policy to just mobile devices ie. allow users who have enrolled their device to access Exchane and block users who have not enrolled their Android or Apple phone?

I asked support but they said this was not possible which I find hard t believe.