Users and Groups

• When organizations both include and exclude a user or group the user or group is excluded from the policy, as an exclude action overrides an include in policy.

• https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-users-groups