The following error may be encountered when provisioning a user to Sentry.
 

Automatic profile push of user <username> to app Sentry failed: Error while trying to push profile update for [email]: Forbidden. Errors reported by remote server: Organization owners cannot be modified.

• Sentry
• Okta Integration Network (OIN)
• Provisioning

The error reported by the Sentry SCIM Remote API server due to Sentry's product limitation indicates that the Service Provider, Sentry, does not allow the 'Organization Owner' role/type user's email attribute to be updated via the Okta System for Cross-domain Identity Management (SCIM) API provisioning.

Please see the following from Sentry's documentation: Sentry/Okta SCIM Integration documentation.

• For security reasons, the "Owner" role cannot be provisioned through SCIM. However, it is possible to deprovision users who have the "Owner" role in Sentry, but are not provisioned through SCIM.
  • For self-hosted users with custom roles, this extends to any role with the org:admin permission

Effectively, Okta sent over the SCIM API request to push profile update to the Sentry SCIM Remote Server upon Sentry app assignment profile mapping field update. However, the Service Provider, Sentry, has deemed this a forbidden change made to the Organization Owner role user and has failed the provisioning task. 

This is a partner-built OIN app supported by the Sentry Partner Support Team (support@sentry.io), and it seems to be hitting Sentry's SCIM provisioning product limitation. It is strongly recommended that the Okta Admin reach out to the Sentry Administrator and contact the Sentry Partner Support team (support@sentry.io) directly for further assistance. 

Related References

• For further details, please read Sentry Okta SCIM Provisioning Documentation.