Add a Policy CSP that allows a device assigned policy to take precedence over a user assigned policy.
With multi-user windows desktops, it would be nice to have a setting to let the device assigned configuration / compliance policies overrule the onces that are assigned to the user logging in.
Since this user might have another desktop that has different requirements.
I.e. a user might have Office ProPlus assigned with a specific set of office components, which is fine for his/hers normal dektop. but on a specific shared computer, we might not want all the same Office components, and we might want it to be in shared activation mode, since this is a multi-user computer.