Issue Summary

Sometimes, the group membership for a synced group in the site does not match the group membership with the SCIM directory data

Steps to Reproduce

1. Setup User provisioning with a third party IDP
2. Provision some groups from the IDP to the site
3. Turn on provisioning from the IDP to run the initial sync
4. Wait for awhile and allow the data to be synced
5. Check the group membership synced

Expected Results

The group membership on the site matches with the AD groups on the IDP.

Actual Results

From the User provisioning configuration page, the group membership shows the expected count and matches with the group members
of the AD groups. There should be no errors reported for those group in the Troubleshooting log section. This indicates that the sync from the IDP to the SCIM directory was successful.

On the site (https://<site>.atlassian.net/admin/group), the provisioned group does not have the correct group members.

Note : This bug does not apply if the User provisioning configuration page reports errors for the groups or the group summary does not match with the data on the AD groups..

Workaround

The scim directory data may not be in sync with the site group data.

1. Add or remove group members on the AD group to trigger another sync.
2. If problem persists, please contact Atlassian support.