App Service Group Filtering
By default, tokens passed by Microsoft to App Services will contain all the groups that a user belongs to, up to a limit of 100 groups. This means that some groups may not be included with a user's token, and therefore the user may not be able to access all the resources that they are assigned.
Restricting the types of groups returned in the token can help (as described in this Microsoft article), but otherwise you can apply a filter text filter (as described in this Microsoft article).
