Do you maybe have some kind of integration in place that is automatically provisioning/updating user accounts from another system?

We do have a sync with Salesforce a few times a day to update user information. However, nothing changes in user’s profile on the Salesforce side regarding managing a team/individuals, so not sure why the sync would “disable” it for someone who had no change.

I just had the user reach out to me again notifying me they lost access to “My Team”.

I reviewed Notifications to see if I could set something up to notify me if a specific branch of users has this attribute modified, but Notifications cannot get that granular apparently. I can set it to the branch I care about, so that’s at least something.

If anyone else has experienced this, I hope you were able to find a resolution because this is painful every week.

I would also go in the same direction of @alekwo.When we have a similar issue, it usually comes from an integration. 

You can check in your Audit Logs to see if the user has been modified recently and by whom. We recently had a PowerUser inadvertently changing the manager value, so this might also be something to look for. 

If you are using the API, you might want to double-check if the value "can_manage_subordinates": false is passed in a user update. If false, this will turn off the manager toggle.

Good luck in your research and feel free to send us an update!

Okay, the notifications in email form are pretty much spam.

Overnight, I have over 100 emails notifying me that individuals in the selected branch have been modified. And some are multiple of the same user in a single minute. 

Another update, there is no “granularity” at all in this notification, so it’s pretty useless.
I logged into our platform and it immediately sent me an email notifying me that my user profile was modified.

So I’m going to scrap this idea.

I’m still open to other suggestions.

@Sébastien Arbour , I did check the audit log and I can see several instances of “User Modified” events against the target user I know this is happening to, and I see my event where I modified their profile.
However, the event details are vague and nondescriptive, so it’s hard to tell what is being changed.

At least I narrowed down it’s definitely not another user doing this.

@dhall, did you also check who was the “Operated by” for the previous modifications for your known target? I know that you don’t get all the details out of the Audit Trail (and I share your frustration), but maybe you can try to combine a notification you’ve received with one of those modifications? You would then see who might be being these changes, although I suspect this will be an automation of some sorts.

Good luck in your investigation!