## TL;DR
Reconcile the IdP groups with the GitHub teams: the sync fails where the two disagree about who belongs where. Fix the mapping, then re-sync.

## Error
```text
GitHub SCIM sync failed: team membership mismatch
```

## Steps
1. Identify the mismatched teams from the SCIM provisioning logs. Expected: the affected teams known.
2. Compare the IdP group membership with the GitHub team membership for those teams. Expected: the discrepancies listed.
3. Fix the source of truth: update the IdP groups (preferred) or adjust the team mappings in the SCIM config. Expected: both sides agree.
4. Re-run the sync and verify team memberships match. Expected: sync succeeds.

## When to use
- SCIM sync fails on team membership mismatches
- Teams were renamed on one side only
- Manual team edits fight the sync

## When not to use
- The sync fails on authentication (a credential problem)
- Users are missing entirely (a provisioning problem)
- You do not use SCIM for teams (manage teams manually instead)

## Tool compatibility
GitHub SCIM with Okta or Entra as the IdP.

### Variant phrasings
### mismatch after renaming a team
Renames break the mapping. Update the SCIM config to the new name.

### manual GitHub team edits keep getting reverted
That is the sync working as designed. Make the change in the IdP group.

## Why it happens
SCIM treats the IdP as the source of truth for team membership. Any out-of-band edit on the GitHub side creates a mismatch the next sync flags.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Jq0j7mDm8moOl3KhqJT_zQ