If you use external authentication services such as QR codes with individual mapping or individually configured interfaces, group assignments of users are always synchronised with the external service. However, you can still make manual group assignments that are not covered by the external system. To protect the manually assigned groups and to prevent them from being overwritten by the synchronisation when logging in again, you can enable this configuration per group.
Exclude a group before SSO synchronisation
Navigate to the menu item Groups and select the group you want to exclude from SSO synchronisation from the list of visible groups. In the editor on the right-hand side you will find the button Show advanced settings.
In the advanced settings section, you will find the option Prevent unlinking added users on SSO login. If you activate this option, it applies to all added users.
The added users remain assigned to this group, even if the group assignment changes via an SSO-connected user database.