Have you seen this video by Matt Soseman on Conditional Access App Control in MCAS? https://youtu.be/CvsjM8TX81c

Has a lot of tips and guide how to enable
www.000webhost.com