- Check TOTAL (Provisioning) app assignments and push group membership, not the OIDC app assignments. SCIM test fails (401, invalid token)
- Re-copy the SCIM token from TOTAL and paste it again, then re-test API credentials. Avoid leading or trailing spaces. User is provisioned but missing admin rights
- Confirm the TOTAL-Admin group is pushed and the user is a current member.

