Steps to reproduce: 

• Create a user that's part of 2 separate Entra AD groups
• Create 2 mappings that give 2 different user roles to those 2 separate AD groups (roles are different level of access)

Result:

Sometimes users get assigned a role that has less permissions than necessary. I have yet to find out the logic behind which user role will be the "final". The user gets all Zabbix group memberships correctly.

Expected:

Users get assigned the highest role among mappings.