We have the same issue when we run AD importer, which we do weekly since we hire/lay-off people on a seasonal need. I believe this has been noted by the team and is currently logged.
"When importing data from an Active Directory, you cannot configure the Self Service access level for the user based on the Location and Department field mapping. - DRZOZ-12828" which I think is directly related to why each AD import overwrites/resets the setting in Self-Service. I am just thankful I only have a handful of people I have to go back and reset their Self-Service settings.