Are you setting the exclusion in the cloud console or the endpoint? The cloud setting will ALWAYS overwrite the endpoint setting eventually.