An organization is using AWS IAM Identity Center (successor to AWS SSO) integrated with their on-premises Active Directory. Users are complaining about access denied errors when assuming roles in member accounts, despite being in the correct AD groups. Which TWO areas should the architect investigate? (Select TWO)

Check if the IAM users in the member accounts have the correct policies attached.

Verify the VPC Peering connection between the member accounts and the on-premises AD.

Review the Permission Sets assigned to the AD groups in IAM Identity Center.

Check the Service Control Policies (SCPs) applied to the member accounts.

Ensure the AWS Directory Service AD Connector is deployed in every member account.

Verify the SAML metadata file is uploaded to each member account.