I have 2 role definitions both having AD resource which enables AD entitlement. I have a user with both roles assigned.
When I remove one of the two roles from the user I assumed user's AD entitlement is intact but that was not the case. AD entitlement was removed when a role with AD resource is removed even when user is left with another role with AD resource. Is this normal behavior? Can it be changed?