Issue Summary

When the number of license seats is already exceeded and users have product access via pushed groups from user provisioning, these users can't be added to any additional groups with application access, even though they already consume a license.

Steps to Reproduce

1. Make sure to have a product like Confluence and Jira, with an annual plan to get its license exceeded (monthly plans will automatically upgrade to the next tier).
2. Have a number of users almost reaching the license limit.
3. Configure user provisioning and grant product access to the synced groups. This will allow the license to be exceeded.
4. For one of the users that already have product access because of the synced groups, try to add the user to any other local group that already has product access (for example, the default access ones).

Expected Results

As the user already has application access, the user should be added to the group without issues.

Actual Results

The following is displayed and the user does not get added to the group(s):

Unable to add the user to that group

You've reached the maximum number of users for your plan. To add this user, upgrade your plan.

Workaround

Besides upgrading the plan or reducing the number of consumed licenses, remove a few users from the externally synced group (via the identity provider), add the users to the desired groups and then, re-add the users to the synced group.