Hi and thanks for any support

I have setup a second google workspace for our devs to use google cloud. we are only using Cloud Identity option, to provision users for GCP access on a different domain. Initial deployment, I used a custom attribute in okta, to cut the @xxx.com off and append the new domain name. This worked properly and users logging into the new workspace had the new domain username. This had both group and individual assignments.

After about a week, some users that never logged in were suspended in google for "abuse". These accounts become permanently suspended in google, so I removed them on google workspace. In Okta, I had to remove the individual assignments and reassign to get the accounts reprovisioned into google. Is there any method to do this for the group users also with disturbing the groups? Those accounts are not being pushed anymore.