Explanation:

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Official Study Guide and Microsoft Learn - Manage Conditional Access policies module, when an administrator creates a Conditional Access policy using the built-in Require password change for high-risk users template, the policy is automatically pre-configured with specific include and exclude assignments.
By default, this template targets "All users" in the tenant because the policy is designed to detect and remediate risky sign-ins or compromised accounts across the entire directory. However, since Azure AD B2B guest accounts and external users often have limited sig n-in scopes and cannot be subjected to organization- specific password policies, Microsoft's security baseline specifically excludes all guest and external users by default.
The intent behind this default configuration is to apply the password change requir ement to internal users while avoiding unnecessary enforcement on guest identities that do not manage credentials within the host tenant.
From the Microsoft Learn - Conditional Access policy templates documentation:
"When you create a policy from the Requi re password change for high-risk users template, the policy is configured to include all users and exclude all guest and external users by default."