Steps to reproduce:

1. SSO with Azure AD / SAML (see attached screenshots)
2. The roles (builtin "Super Admin role" and a custom role with restricted permissions of User type "Super admin") are mapped to two AD groups in SAML config
3. User is member of both AD groups
4. User signs into Zabbix

Result:
User gets custom role assigned, which has restricted permissions

Expected:
User gets role "Super admin role" assigned
-> Based on the docs: If a user matches several Zabbix user roles, the user will get the highest permission level among them

We use the User type "Super admin" to give the members access to all host groups, even newly created ones.