If a user is in more than one Azure AD group, a DENY permission set in one group applies to the user in all groups the user is in. Because the permission is set to DENY for the user at the lowest possible level, the user's usage of the resource is affected in all groups they are in because denial always takes precedence.
For example, if a user is in the Contributor group and in the Project Administrator group and DENY is set for a specific permission in the Contributor group, that permission is denied for the user in the Project Administrator group, too. In this scenario, you can use the Not set option.
For more information about permissions states, see Permission states.