SecOps IAM based access controls

Hi, for some reason, I cannot give GCP users access to our SecOps instance even when the instance should be configured in a way that authentications and authorizations should just work with IAM. I have added the needed roles for the users. I had to give accesses with the Group Mapping feature, by adding the users there with their email-usernames. They can access but they do not have the chronicle.propertySchemaDefinitions.get permission even if I give them Tier1-Tier3 roles. Therefore, they cannot really work with the cases. How I can give them the permission or how I can fix the IAM access feature? How to debug it? I’m not gonna give them admins to SecOps..