Thanks.
It looks like I’m getting some “nonce already expired” messages (as reported here which seem to correspond to the users losing group status.
Any suggestions? I’ve had to disable group membership updates via SSO until this is sorted because I’ve gotten so many complaints!