Firewall Policy checking AD Users

Hello Team,

I have a customer with a firewall policy that grants access to the internet based on membership in an AD Group.

The policy works fine except for when a user logs into their PC before connecting to the wifi - in this case the user connects to the network but Fortigate doesn't grant access to the Internet until the user locks and unlock their machine; sometimes the user doesn't even notice for an hour if they just check internal systems.

Is this working as intended or is there a way of checking the membership even after the first login?

thanks in advance

F.