unidentifiable applications allowed ?

I have a policy (service All) where I want to only allow access to two applications. Although ssl inspection is not an option, Fortigate recognizes those two applications fine.

In the app control profile all application categories and unknown applications are set to block. The two applications I want to allow are added to the overrides with action Monitor. See attached screenshot.

Fortigate however decides to allow other traffic, traffic whose application can not be identified. Is this expected behaviour ?