We found that global entitlements to AD groups don't sync with IDM 2.6, 2.7, or 2.7.1.  I opened a case with VMware and was provided a patch that resolves the issue.  The appliance now shows as 2.7.1.1.  The issue is supposed to be resolved IDM 2.8.