When a user is added to an AAD security group and the AAD security group is added to the environment as a Team (group team), it allows the users of that AAD group to access the assets within the environment that they have access to. However when the user is auto-provisioned in the environment the auto-provisioning process adds the user to the default root business unit of that environment instead of the business unit to which the group team is associated with. Please consider assigning the user to the group team that they are part of at the time of provisioning or allowing some automation to make this easier for administrators.