Non SSO Accounts have admin rights

[Jayson Larner]

Using Jira version 8.20.2#820002

I have an SSO setup between the local Jira server and our Office 365 account and this works just fine for all domain-joined users we manage through this service.  I am now working to set up some non-domain joined users from an outside company we need to be able to get tickets from and, while I have this working using 2 test email accounts (Gmail and outlook.com), these two accounts come in with admin rights and can see everything which is not good.  What could be causing these non-SSO accounts to have full rights?  I am looking at my user accounts and the groups they are assigned to are all the same group rights so I am not sure what would allow these new accounts to see stuff others can't see.