Cloud Access Policies are evaluated in order from top to bottom. Processing stops at the first rule that evaluates true and is NOT "Monitor only mode". There is no default deny implied, and it must be explicitly added.
To reorder Cloud Access Policies:
- Go to Policy > Access Control.
- Click the left-side vertical box until the Move cursor appears.
- Drag the policy to the wanted position (top or bottom).