I have a single ZESM IR8 server setup.

All security throughout my environment, ZESM and otherwise, is based on group membership.

If I change a user from one group to another group this change does not reflect in their policy assignment.

Scenario: GroupA = standard user policy, GroupB = power user policy.

UserA was first in Group A and therefore got the standard user policy.
UserA now requires the power user policy.
Remove UserA from GroupA and add UserA to GroupB (in iManager).
UserA does NOT get the "power user" policy that is assigned to GroupB

Am aware that I can assign the policy at a user level but this is NOT an option in my environment. All security assignments MUST happen at a group level.