Assignment Detail looks good on users with many groups associated with PSU Roles and on a user that only has one group assigned to a PSU Role.
In the claims json file, it does show the correct object id and tenant. But looking at it, for user that it is working on I see all of the group claims, but for users that it is not working on, I see this:
{
"Type": "_claim_names",
"Value": "{\"groups\":\"src1\"}",
"ValueType": "JSON",
"Issuer": "https://sts.windows.net/<tenantId>",
"Properties": "System.Collections.Generic.Dictionary`2[System.String,System.String]"
},
{
"Type": "_claim_sources",
"Value": "{\"src1\":{\"endpoint\":\"https://graph.windows.net/<tenantId>/users/<userObjectId>/getMemberObjects\"}}",
"ValueType": "JSON",
"Issuer": "https://sts.windows.net/<tenantId>/",
"Properties": "System.Collections.Generic.Dictionary`2[System.String,System.String]"
}
Tenant and User Object ID were redacted, but are correct in the json file.