Current behaviour
When a synced group is deleted or unassigned from the Atlassian Cloud app in the identity provider, SCIM provisioning will delete the group from the Atlassian organisation/site.

This can be problematic if a group was unintentionally removed or unassigned due to either user error or an issue in the identity provider, as there is no way to restore the deleted groups and any product roles or in-product permissions assigned to the group.

Proposed solution
Instead of deleting the group in Atlassian, it may be safer to unlink the groups from being synced with the identity provider when they are removed or unassigned. This would be similar to how we de-provision users - we deactivate their Atlassian account instead of deleting it.

Once unlinked, the groups are managed within the organisation and an admin can choose to delete them permanently as an additional step. Or the can reprovision the groups from the identity provider side.

It could either be made the standard behaviour or a provisioning configuration option.