Cloud devices that have been Entra joined or Intune enrolled are not detected as domain joined devices so therefore not able to restrict applications for these devices.