We currenly have a single realm and two role mapping rules.
One for users who are restricted to VPN in only between certain hours (6:00 AM and 9:00 PM) enforced by an expression (groups="VPN Non-Exempt Staff" AND loginTime = (6:00AM TO 9:00PM))
and another that allows any VPN access time if they are in an AD group "VPN Users"
If a user in the "VNP Non-Exempt staff" logs in at 8:55 PM they should be allowed due to the expression time frame.
BUT...
shouldnt the Dynamic policy evaluation re-eveluate and then end the users session soon after?
We have it set for 60 minutes and both Refresh roles and Refresh resource policies checked.
