Non-SSO users in PSA who also have Azure AD guest accounts keep losing their security roles. Why?

This happens because users belong to multiple groups, and they have multiple mappings on PSA side. They should check the Mapping Priority Order to get the correct mapping applied. Otherwise, the security roles will be dropped.