Identity sync mapped the wrong person
How to fix a directory sync that created a duplicate, missed someone or gave the wrong role, before you change any access.
Identify the mismatched person and account
A person is missing, has the wrong access, or still appears after an identity change. Start with the intended organization and the stable identity reference used by the configured integration, then compare what you expected with what you see.
An email address, job title, or directory group name alone does not prove that a particular Lithi role should be granted. Do not fix a mismatch by assigning a broad administrator role.
Check the relevant evidence
Wrong account or connection: verify the configured organization and identity source. Do not copy a person from another tenant as a workaround.
Person missing: check whether the source sync completed and whether the configured mapping includes that person. A partial read is not evidence that everyone absent should be removed.
Role differs: compare the current approved mapping with the resulting Lithi grant. A directory attribute is evidence for the mapping, not permission to invent a new privilege.
Leaver still has access: check membership, personal keys, sessions, and any separately owned service identities. One removal event does not prove every credential was revoked.
Operation unavailable: stop and use the supported administrative path. Do not assume a full provisioning standard is available because the integration uses that name.
Preserve ownership during repair
Use the authorized account administrator, not a shared work key. Review an intended change before applying it, and read back the affected membership or grant afterward.
Transfer a service identity's ownership explicitly when required. Removing a person does not authorize another account to inherit that service or its data. Preserve any verified changes while separately reconciling incomplete or uncertain actions.
Confirm or escalate
Success is the intended person with the reviewed current access, or a confirmed removal with dependent access accounted for. Stop when the source identity, mapping, or resulting grant is uncertain.
Use Contact Lithi with safe connection and identity references, the expected role, observed state, time, and error code. Do not send directory exports, employee records, tokens, or private messages.