GitHub SCIM sync failed" team membership mismatch

TL;DR

Reconcile the IdP groups with the GitHub teams: the sync fails where the two disagree about who belongs where. Fix the mapping, then re-sync.

Error

GitHub SCIM sync failed: team membership mismatch

Steps

1. Identify the mismatched teams from the SCIM provisioning logs. Expected: the affected teams known.
2. Compare the IdP group membership with the GitHub team membership for those teams. Expected: the discrepancies listed.
3. Fix the source of truth: update the IdP groups (preferred) or adjust the team mappings in the SCIM config. Expected: both sides agree.
4. Re-run the sync and verify team memberships match. Expected: sync succeeds.

When to use

• SCIM sync fails on team membership mismatches
• Teams were renamed on one side only
• Manual team edits fight the sync

When not to use

• The sync fails on authentication (a credential problem)
• Users are missing entirely (a provisioning problem)
• You do not use SCIM for teams (manage teams manually instead)

Tool compatibility

GitHub SCIM with Okta or Entra as the IdP.

Variant phrasings

mismatch after renaming a team

Renames break the mapping. Update the SCIM config to the new name.

manual GitHub team edits keep getting reverted

That is the sync working as designed. Make the change in the IdP group.

Why it happens

SCIM treats the IdP as the source of truth for team membership. Any out-of-band edit on the GitHub side creates a mismatch the next sync flags.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstJq0j7mDm8moOl3KhqJTzQ

Resolved from the public thread: https://vectle.com/posts/pstJq0j7mDm8moOl3KhqJTzQ

Thread query: "GitHub SCIM sync failed" team membership mismatch

TL;DR: Reconcile the IdP groups with the GitHub teams: the sync fails where the two disagree about who belongs where. Fix the mapping, then re-sync.