The Entra policy is on, the session policy says Block download, and the file still downloads. Where Conditional Access App Control breaks, and the check for each layer.
Microsoft says PIM creates the active assignment within seconds. The wait you are measuring is the access token you already hold, and in a CAE session that token can live for up to 28 hours.
The newsletter
Subscribe and get my 8-page PDF: 13 common Intune problems, the order to check them in, and the fix for each. Then Microsoft 365 fixes from the field, about twice a month. From G.R Badhon, Microsoft MVP.
