Issue Summary

Provisioned users can be removed on the site or org's Users administration. This leads to groups on the site or org to not be in the same state as the provisioned data.

Steps to Reproduce

1. Add UserA to GroupA in your Identity Provider
2. Provision GroupA to Atlassian
3. On the site or org's Users administration, remove UserA manually. 

Expected Results

UserA should not be allowed to be removed on the site level

Actual Results

UserA can be removed.

Workaround

Re-invite the user in the site or org's Users administration
Remove and re-add the user to the provisioned groups in the Identity Provider to trigger a new sync for the user.