If you enable nested group extraction in the LDAP policy it will do. It’s under more options on the server definition