"Access Denied" on WorkspaceONE / IDM

I've deployed a new IDM to present RDSH and SaaS apps. I setup a directory using "Active Directory over LDAP". My groups and users sync properly.

I am getting an "Access Denied" error when trying to log into WorkspaceONE.

Full Error:

Access Denied

You do not have access to this service. Contact your administrator for assistance.

Any thoughts? I cannot seem to find anywhere this is blocked or denied. I've presented 1 SaaS app. The users and groups show this app as entitled.

I've downloaded the logs from my IDM and the connector.log looks clean. Are there other logs to check?

Thanks,

Mike