Put a user in the appropriate AD group, for example JIRA-Developer and JIRA-User on the domain controller. User is in both groups.
Go to Jira. Re index. Go to User Administration | User Directories - AD is R/O and is first. Click Synchronize. Sometimes does something, mostly it placates the admin...
User is still not available in Jira.
Wait 24 hours.
Now User shows up.
Crazy. I don't understand why Atlassian doesn't take AD more seriously. This impacts my business.