SCIM group sync
When directory sync (SCIM) is enabled for the enterprise, the identity provider owns the member lifecycle. Creating, resending, or deleting invites and deleting members via API return 403 forbidden.
Role changes and organization assignments remain available unless SCIM group sync is also enabled, in which case the directory groups own enterprise roles, organization memberships and group memberships too, and changing member roles, assigning or unassigning organization members, and adding or removing group members return 403 forbidden.
API Docs: SCIM