https://learn.microsoft.com/en-us/defender-cloud-apps/use-case-proxy-block-session-aad#create- a-block-download-policy-for-unmanaged-devices Defender for Cloud Apps session policies allow you to restrict a session based on device state.
To accomplish control of a session using its device as a condition, create both a conditional access policy AND a session policy.