Security rule resource.published="true" doesn't work as expected
We want to give the end users access to all apps where the AD_GROUPS custom property is not filled in, but not the apps that are in the My Work stream. In order to accomplish this we have the following security rule:
Resource filter = App_*
Advanced conditions = resource.@AD_GROUPS.empty() and resource.published="true".
However, the apps in the my work stream are still visible.