Found a workaround after upgrading to 2.8 and still having the issue.  If i change the AD groups to a Universal security group versus a global security group it will sync the entitlement of the group in Identity Manager.