Intune policies for schools, assign different device policies for group of users

Hi,

I try to create the following scenario, but I have lucky results, and I still hope, that there is a working solution…

Devices are azure ad joined, and managed by intune, so far so good. Used Windows 10 Enterprise, 1809 with current patch level, and tried also with new Insider Preview 18334.1

I have a group for teachers and students, then I created a device policy "Teacher Settings" and "Student Settings" for Windows 10. To simplify it, I set only a desktop wallpaper, teachers get a blue one, and students a yellow one. I set the assignment of the policies to the teacher group and to the student group.

So now I take one of my devices, and login as teacher, perfect I got my blue wallpaper.

Now I sign off, and sing in with a student account, and I expect a yellow wallpaper, but I got the blue one.

If I take another device, and my first login is with the student, I got the correct yellow wallpaper, now I sign off, and on as teacher, guest what I see, yes the yellow wallpaper...

I found a way to correct it, simply use taskmgr and restart explorer.exe, but this behavior couldn’t be correct.

That was my first pitfall, but I tried to disallow students access settings app, but I allow teachers to access it, and the behavior is the same. Last policy that was used, wins over the next logon. Here helps the trick, running gpupdate after logon, and restart explorer.exe too...

So any hints, tips to solve this issue???