1) I assume you’re not using Domain Users? Is the entitled group properly sync’d?

2) What happens if you assign an individual account and sync? Does it work correctly? 

3) Is your service account used for Horizon syncs configured as a read-only admin in Horizon at the root?