403 Forbidden - Getroles API doesn't work for some users

**Describe the bug**

I've configured the Getroles API and custom authentication as per the documentation which works for myself and some of my colleagues however a few colleagues have told me that no matter what browser they use / if they use incognito etc they get 403 forbidden when trying to access my static site. They are a member of the same group that I am which is a generic AD group for our company, I've tried to see in the app insights logs what the issue might be but the logs aren't detailed enough / don't show what role the user has, if any.

**To Reproduce**
the affected users have tried to clear cookies, use different browsers etc to no avail. They have the same group membership as myself.

```
{
"routes": [
{
"route": "/*",
"allowedRoles": [
"reader",
"admin"
]
}
],
"responseOverrides": {
"401": {
"statusCode": 302,
"redirect": "/.auth/login/aad"
}
},
"auth": {
"rolesSource": "/api/GetRoles",
"identityProviders": {
"azureActiveDirectory": {
"userDetailsClaim": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
"registration": {
"openIdIssuer": "https://login.microsoftonline.com/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"clientIdSettingName": "AZURE_CLIENT_ID",
"clientSecretSettingName": "AZURE_CLIENT_SECRET"
},
"login": {
"loginParameters": [
"resource=https://graph.microsoft.com"
]
}
}
}
},
"globalHeaders": {
"Cache-Control": "no-cache"
}
}
```
```
const fetch = require('node-fetch').default;

// add role names to this object to map them to group ids in your AAD tenant
const roleGroupMappings = {
'reader': 'xxxxxxx-xxxxx-xxxxx-xxxxx-xxxxxxxxxxxxxxxx',
'admin': 'xxxxxxx-xxxxx-xxxxx-xxxxx-xxxxxxxxxxxxxxxx'
};

module.exports = async function (context, req) {
const user = req.body || {};
const roles = [];

for (const [role, groupId] of Object.entries(roleGroupMappings)) {
if (await isUserInGroup(groupId, user.accessToken)) {
roles.push(role);
}
}

context.res.json({
roles
});
}

async function isUserInGroup(groupId, bearerToken) {
const url = new URL('https://graph.microsoft.com/v1.0/me/memberOf');
url.searchParams.append('$filter', `id eq '${groupId}'`);
const response = await fetch(url, {
method: 'GET',
headers: {
'Authorization': `Bearer ${bearerToken}`
},
});

if (response.status !== 200) {
return false;
}

const graphResponse = await response.json();
const matchingGroups = graphResponse.value.filter(group => group.id === groupId);
return matchingGroups.length > 0;
}
```
**Expected behavior**
I expect that these users can login to the site as expected as they should be granted the reader role.

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Device info (if applicable):**
- OS: windows10, android
- Browser, chrome, edge

**Additional context**
Site works fine for a majority of users, is it possible to view the App/API logs to see why the role isn't set for these specific users? EDIT - I just found this issue which looks to be very similar / the same as mine : https://github.com/staticwebdev/roles-function/issues/3 users in our tenant with the issue also have over 100 groups but not everyone with over 100 groups is affected like myself.....