When we are importing users that have set up a custom default group - the job will not set up relations for custom access. We should likely do this in the migrator. 

• Look up policies related to the custom group and run them through existing migration logic 
• This should end up writing workspace -> role binding, role binding -> group#member, role binding -> role tuples
• This may really only be a gap for system roles, because the custom role migrator should already create these. In fact, this may just be a part of a larger gap around system role assignments in general. I don't think any custom groups are getting these either. Solving that may way just solve this problem too. So this may really be about migrating system role assignments more than it is about custom default groups.

Reference: Slack Thread