In order to match an identity-based policy, the FortiGate unit checks the IP information.
Once inside the policy, the following logic is followed:

A.
First, a check is performed to determine if the user’s login credentials are valid. Next, the
user is checked to determine if they belong to any of the groups defined for that policy.
Finally, user restrictions are determined and port, time, and UTM profiles are applied.

B.
First, user restrictions are determined and port, time, and UTM profiles are applied. Next,
a check is performed to determine if the user’s login credentials are valid. Finally, the user is
checked to determine if they belong to any of the groups defined for that policy.

C.
First, the user is checked to determine if they belong to any of the groups defined for that
policy. Next, user restrictions are determined and port, time, and UTM profiles are applied.
Finally, a check is performed to determine if the user’s login credentials are valid.

Explanation: