the device roles of the user are all except useradmin. No OU roles defined. Devices are in two different OUs.
If i understood your explanation right the user shopuld not be able to configure the vpn if the devices are in two different OUs. So the button should be diabled, but it isn't!