did the tag-sync job cover the row-filter tags too, or just the column-mask ones? that's the bit i'd worry about drifting, since a missing row-filter tag fails silently the same way.
yeah if they show as members in the databricks account group that usually means they ended up as active or direct members in entra, not just eligible in pim, so the grants are probably live now. scim only syncs actual membership, it doesnt understand...
