AD/LDAP Group Sync Does Not Promote Members to Team Admin

Applies to: Mattermost Server (Enterprise) with AD/LDAP Group Sync, v10.x and later.

Symptoms: Users in an admin-flagged AD/LDAP group are added to a team as Members but are never promoted to Team Admin on scheduled synchronization.

🛑 Problem

When an AD/LDAP group is linked to a team with the Team Admin role assigned, you expect members of that group to receive the Team Admin role automatically on the next AD/LDAP synchronization. Instead, affected users are added to the team as regular Members and are never promoted, even though the group is correctly flagged as admin and the users are active members of it.

This happens because Mattermost applies group-to-team role assignments (Team Admin/Member) only on teams that have Sync Group Members enabled (group-constrained). On a team where Sync Group Members is off, the sync still adds users as members (when the group's auto-add is on) but never reconciles their roles, so no one is promoted to Team Admin. The synchronization job reports success, and no error is logged.

You can confirm the condition directly in the database. For the affected team, the group-to-team link shows the admin flag set correctly but the team is not group-constrained:

SELECT Id, DisplayName, GroupConstrained FROM Teams WHERE DisplayName = '<team name>';
-- GroupConstrained = 0  (Sync Group Members is OFF)

SELECT gt.GroupId, ug.DisplayName, gt.SchemeAdmin, gt.AutoAdd, gt.DeleteAt
FROM GroupTeams gt JOIN UserGroups ug ON ug.Id = gt.GroupId
WHERE gt.TeamId = '<team id>';
-- admin group row: SchemeAdmin = 1, AutoAdd = 1, DeleteAt = 0  (flag is correct)

Symptoms

Additional symptoms:

• A user who belongs to an admin-flagged AD group is added to the team as a Member but is never promoted to Team Admin on sync.
• Existing Team Admins are demoted to Member after synchronization on teams that are group-constrained (this is expected: group membership becomes the source of truth for roles).

✅ Solution

Enable Sync Group Members on each affected team so the team is group-constrained. Once enabled, the scheduled synchronization reconciles roles and promotes members of the admin-flagged group to Team Admin automatically. The group's admin flag (SchemeAdmin = 1) does not need to change.

Enable Sync Group Members on the team

Navigate to System Console > User Management > Teams, select Edit next to the affected team, then:

1. Enable Sync Group Members.
2. Confirm the group's role is set to Team Admin in the Roles column.
3. Select Save.
4. Run System Console > User Management > Groups > AD/LDAP Synchronize Now (or wait for the next scheduled sync).

Members of the admin-flagged group are promoted to Team Admin on the next synchronization, with no remove/re-add required. Multiple groups on one team are supported, and a Member-role group does not block an Admin-role group: a user is treated as admin if they belong to any admin-flagged group linked to the team.

⚠️ Important: Enabling Sync Group Members makes group membership the source of truth for the team. Any current team member who is not in a linked AD group is removed on the next synchronization, and the Allow any user with an account on this server to join this team and allowed-email-domain join options are disabled. Confirm all legitimate members are covered by a linked group before enabling it.

Alternative: one-time promotion without group-constraining the team

If you cannot enable Sync Group Members on a given team, re-select the Team Admin role for the group on that team's group link in System Console > User Management > Teams. This promotes the group's current members once.

⚠️ Important: This one-time promotion does not promote future joiners. Users who join the admin group afterward are not promoted until you run this again. Enabling Sync Group Members is the durable fix.

Additional Resources

For more information, see:

Assign roles to group members (AD/LDAP Groups Synchronization)