Access rule Bypass IP Range not working

I’ve got two rules configured in Cloudflare Access. Include IP Range with a /32 for my current public NAT IP. Confirmed on ipinfo

Then a second include rule for allow email ending in.

Cloudflare access doesn’t seem to be respecting the IP rule, it always prompts for an email address, regardless of the IP rule matching.

Any help on how to troubleshoot this further?