Issue Summary

Users with both Customer and Agent permissions from different Azure AD groups don't show agent permissions in the JSM Portal.

Steps to Reproduce

1. Have a single user configured for two different groups in Azure AD
2. Sync the groups with JSM
3. Go to a JSM Project
4. Add one of the groups as Agent
5. Add the other groups as Customer

Note: * If the Admin role is added, the Admin role does take precedence; the issue is only observed for Agent + Customer.{*}

Expected Results

Once the portal is visited, the Agent permissions take precedence, and the user can view the Open work item button when visiting tickets.

Actual Results

Once the portal is visited, the Customer permissions take precedence, and the user can't view the Open work item button when visiting tickets.

Workaround

A workaround is to create more granular groups in Azure AD to ensure that the same user does not have conflicting permissions in JSM.