Hi,
We have configured user roles in our tenant but when users SSO to the portal, the roles are not assigned even though the groups are there. Only if I remove the group from the role, save it and add the group back and save it again does it assign the role.
I’ve had this happen before when the roles were exported/imported into the same tenant or another tenant. Something seems to not transfer correctly and doing exactly what you stated was the 1-time fix needed. Generally I don’t transfer roles via export/import but the only option is to remove these manually from the file which is a pain.