Issue Summary

User migration can set a provisioned group out of sync

Steps to Reproduce

• Provision a group via Atlassian Access (ie. jira-users)
• Add a set number of members from the identity provider to the group.
• Method #1 : Use the Jira migration tool to migrate a user in server in the same group name but the user does not exist in the identity provider.
• Method #2 : Use the Jira add member to group API to add a member to the provisioned group.

Expected Results

The provisioned group is locked on Atlassian cloud (read-only) and can only be updated by the identity provider via Atlassian Access.

Actual Results

The migration tool or Jira REST API are able to add the migrated user to the provisioned group. This puts the provisioned group out of sync with the identity provider.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available