Why AD user account without access role object can access to Endpoint VPN?

[Kirill]

Hello, I have enabled Identity Awareness blade and created allowing rule for Remote access VPN users. 

I added some users in Access role object, and they have access to VPN, it's ok. But when i try to make authorization in Endpoint VPN with AD account which is not in the access role object it has access too, authorization is successful. How is it can be possible ?