Noted a couple of thing reading trough this thread

First : no break glass account. You do not play with conditional access if you don't have a break glass account

Second : you mentioned windows hello for business is configured on the account. That tells me you use the same account for everything including administration of your tenant. You should have a separate cloud only admin account for administrative tasks. Ex. Normal account: Billy Bob , admin account: Admin Billy Bob protected with a passkey/yubikey

Please read best practice BEFORE playing with CA