A provisioner has a setting "Delete group if unmarked provisionable = false". When the group is marked unprovisionable, it correctly leaves the group and membership alone. However, if the group is ever deleted, the memberships get deleted in the group. This happens even if it has been a long time since the group was managed by that provisioner! That is going to surprise people who don't expect this to happen.