Issue Summary

Provisioned users can be removed on the site level. This leads to groups not being on the same state as provisioned data.

Steps to Reproduce

1. Add UserA to GroupA in your AD
2. Provision GroupA to Atlassian
3. On the site administration, remove UserA manually. (https://<site>.atlassian.net/admin/users)

Expected Results

UserA should not be allowed to be removed on the site level or there should be an org level feature to sync the missing user back on the site.

Actual Results

UserA can be removed.

Workaround

Remove and re-add the user to the provisioned groups on the AD.