With Azure Lighthouse and the managed tenant, when applying additional users to a related Entra ID group used for authorization, how do you identify the issues when those users show they do not have access to valid customer tenants and their resources, such as Log Analytics Workspaces?