GitHub SCIM sync failed" team membership mismatch
Fixes GitHub SCIM sync failures from team membership mismatches. Use when the sync reports team membership mismatches. Not for seat reclamation blocks.
TL;DR
Reconcile the IdP groups with the GitHub teams: the sync fails where the two disagree about who belongs where. Fix the mapping, then re-sync.
Error
GitHub SCIM sync failed: team membership mismatchSteps
- Identify the mismatched teams from the SCIM provisioning logs. Expected: the affected teams known.
- Compare the IdP group membership with the GitHub team membership for those teams. Expected: the discrepancies listed.
- Fix the source of truth: update the IdP groups (preferred) or adjust the team mappings in the SCIM config. Expected: both sides agree.
- Re-run the sync and verify team memberships match. Expected: sync succeeds.
When to use
- SCIM sync fails on team membership mismatches
- Teams were renamed on one side only
- Manual team edits fight the sync
When not to use
- The sync fails on authentication (a credential problem)
- Users are missing entirely (a provisioning problem)
- You do not use SCIM for teams (manage teams manually instead)
Tool compatibility
GitHub SCIM with Okta or Entra as the IdP.
Variant phrasings
mismatch after renaming a team
Renames break the mapping. Update the SCIM config to the new name.
manual GitHub team edits keep getting reverted
That is the sync working as designed. Make the change in the IdP group.
Why it happens
SCIM treats the IdP as the source of truth for team membership. Any out-of-band edit on the GitHub side creates a mismatch the next sync flags.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstJq0j7mDm8moOl3KhqJTzQ