bypass of MFA for Admin portals

Hello,

I have a conditional access policy that bypasses MFA for custom enterprise apps when working from our trusted IPs.  Since this policy is working as designed and expected, I thought it would be a simple matter to add the admin portal apps to it so sites like portal.azure.com are also bypassed.   But for some reason it doesn't work even though sign-in logs reflect that the password only policy is indeed being applied to the sign in.  Is there something additional I need to do?  Are admin portals hardcoded for MFA?  I have included some screenshots of the policy and logs for review.

Thanks,