Hello,
We use Microsoft Entra ID (formerly Azure AD) as a provisioning tool to manage access to Zendesk and assign roles/groups via SCIM. The sync by default runs every 40 minutes and usually works fine, but recently we've encountered a recurring issue.
Every once in a while, certain users get their Support role downgraded to a Light Agent. For example, an agent that previously had Specialist or even Admin role ends up as a Light Agent after a sync. This seems to happen during automated provisioning, not manual changes.
I've observed that the the actor in Zendesk logs is always the account owner whose API key Entra ID uses for SCIM calls (which makes sense) and the downgrades often coincide with External ID changes (can be seen in exported Zendesk audit log)
Has anyone else had similar case on their Zendesk setup or perhaps have any insights or ideas what might be causing this?
