Thanks for prompting me to circle back to this @James Terrell, I was able to get SPA to work with native browser by tearing down my SPA apps and building fresh, making sure that Agentless Access was ticked and no restrictions were configured . What I was told after my case was escalated was once you configure an Agentless App with restrictions, you can't modify it "downwards" / less restrictive, as the wizard already puts the CEB enforcement rules in the flow of the "app" launch. Now our users can either launch the SPA published, client browser accessible https://%ourorg%.cloud.com, and launch the unrestricted SPA published app from there in their own browser.