Microsoft Intune + Intune Enrollment Apps - Exclusion required for Conditional Access?

Setting up a test tenant at the moment.

Reading online, I see a lot of varied opinion on this, so thought I’d ask the community.

Some people recommend excluding ‘Microsoft Intune’ and ‘Microsoft Intune Enrollment’ from all Conditional Access policies that include ‘Device Compliance’ checks.

So they have two policies as a baseline (all plat): - MFA Requirement for All Users (All Cloud Apps - Nothing excluded) - Device Compliance for All Users (All Cloud Apps - Intune apps excluded)

So, both policies apply - just the compliance check doesn’t check against the two excluded Intune apps I’m guessing to avoid the chicken-egg situation when it’s a requirement.

Does this sound about right, or are exclusions not required at all?