I'm setting up a new LFDS install and am trying to get this to work for a couple specific AD groups.  I'm able to add the new identity provider rules without a problem, and when the synchronization runs some users are added....but not all the users in the AD group!

I haven't been able to identify any pattern as to which users are added/not added during the sync.  I have plenty of licenses available since I'm just starting to set up this LFDS server so that's not an issue.

What can cause this type of behavior?