Honestly I’ve worked in places with many 1000s of AD groups. At some point, that’s just what fine grained access control means, I’m not sure there’s much point

Honestly I’ve worked in places with many 1000s of AD groups. At some point, that’s just what fine grained access control means, I’m not sure there’s much point in trying to prematurely optimise for fewer groups. Of course, if there’s a way to simplify the access (like are there truly 5 roles or in practice do people end up bucketed in to 2/3), or if you can configure one role group with the user is always in and group per workspace that’s always ideal, but that might well come back to bite you.