AzureAD Google Cloud Connector user provisioning failure - google-cloud-platform

Question

While testing automated user/group provisioning with the AzureAD Google Cloud EA, I am seeing a number of HTTP 403 errors at the Scoping phase of the user provisioning process that look like below:
Description: Failed to evaluate scoping of a source entry User 'user#foobar.com'
Error Code: GoogleAppsCannotAccessResourceOrApi
Error Message: An error has occurred when our provisioning service tried to evaluate scoping of a source entry.
{
"error": {
"code": 403,
"message": "Not Authorized to access this resource/api",
"errors": [
{
"message": "Not Authorized to access this resource/api",
"domain": "global",
"reason": "forbidden"
}
]
}
}
To note: This issue affects many users but not all of them. Many more are successfully provisioned.
Also, to note: There are no scoping filters in place (source scope is "All records").
This looks similar to azure ad user provisioning with g suite but that question hasn't been answered and I tried removing the user's manager from the attribute mapping (as implied in the last response) but no luck.

Answer 1

So I figured out the issue. First, it turns out that the problem has nothing to do with scoping, regardless of what the provisioning logs were saying.
My problem was that I perform a custom attribute re-mapping of the users UPN, as G Suite is configured for another domain and that I forgot that we have a mishmash of upper and lower case domain names in our users' UPNs.
My expression failed to normalize the UPNs to lowercase before performing a case-sensitive replacement for the old domain to the new domain. Once I added a ToLower expression, the scoping errors went away.