In AirWatch 8.1 and 8.0 FP8+, the Max Allowable Changes option configurable under the settings of a user group does not function correctly. Normally, this setting works in conjunction with the Auto Merge Changes option to require administrator approval if the total number of changes during a user group sync exceeds the specified value. However, in affected versions if Auto Merge Changes is enabled, then all changes will be automatically applied even if the value exceeds the Max Allowable Changes. During certain circumstances of timeouts or errors during the syncing process of large user groups, this can result in unintended consequences such as profiles getting removed from devices if they are assigned based on user group membership.
As a workaround, you can disable the Auto Merge Changes and Add Group Members Automatically options for all configured user groups. Note that this would require an administrator to approve any changes (such as the addition or removal of users) after every scheduled user group sync. However, it would eliminate the scenario of drastic changes being made to a user group during error/timeout scenarios for large user groups.
This issue has been given identifier CMDM-191264. Our product team has been engaged and is working on a resolution with an update to the AirWatch Admin Console.