We want our users to be able to access our Salesforce instances using the Salesforce Mobile app, authenticated using AzureAD single sign-on, and subject to conditional access rules which require their mobile device to be compliant and company-managed. This doesn't seem to be possible. It seems conditional access policies only apply to apps accessed through a browser.