You have a Microsoft 365 subscription that contains three users named User1, User2, and User3...

In Conditional Access (CA), assignments determine who the policy applies to using Include and Exclude lists. A user targeted by Include but present in Exclude is not affected. CA evaluates all applicable policies for a sign-in. If any applicable policy has Block access, the sign-in is denied, even when other policies would grant access. When policies Grant access with conditions, the user must meet the configured controls (for example, Require device to be marked as compliant) to succeed.

Applying these rules: Policy1 includes Group1 and excludes Group3, targets All resources, and Blocks access. Group1 contains User1 and User3; Group3 contains User1. Therefore, User1 is excluded from Policy1 and not blocked, but User3 remains included and is blocked from all resources. Policy2 includes Group2, targets App1, and Grants access requiring a compliant device. Group2 contains User2 and User3; all devices (Device1–Device3) are Compliant. Thus, User2 can access App1 from Device2 because Policy2 is satisfied and no block applies. User1 is not in Group2 and not blocked by Policy1, so access to App1 from Device1 is allowed. User3, however, is affected by Policy1 (Block); block overrides any grant in Policy2, so User3 cannot sign in to App1 from Device3.