Conditional Access excludes the break-glass user but not the device-registration prerequisite

The emergency account is excluded from the main policy, yet login still fails because an upstream prerequisite step is governed by a different device rule set.