@@ -81,15 +81,8 @@ export const POST = withRouteHandler(
         organizationId,
         currentOwnerUserId: session.user.id,
         newOwnerUserId,
-        currentOwnerLeaves: alsoLeave,
       })
 
-      if (transferResult.refusalCode) {
-        return NextResponse.json(
-          { error: transferResult.error, details: { code: transferResult.refusalCode } },
-          { status: 403 }
-        )
-      }
       if (!transferResult.success) {
         return NextResponse.json(
           { error: transferResult.error ?? 'Failed to transfer ownership' },
@@ -162,11 +155,15 @@ export const POST = withRouteHandler(
       deliverRunStops(removeResult.stoppedRuns)
 
       if (!removeResult.success) {
-        logger.error('Transfer succeeded but self-removal failed', {
+        const outcome = {
           organizationId,
           userId: session.user.id,
           error: removeResult.error,
-        })
+          refusalCode: removeResult.refusalCode,
+        }
+        if (removeResult.refusalCode)
+          logger.info('Transfer succeeded; policy kept the previous owner as admin', outcome)
+        else logger.error('Transfer succeeded but self-removal failed', outcome)
         return NextResponse.json(
           {
             success: true,
 
@@ -1,7 +1,7 @@
 'use client'
 
 import { useState } from 'react'
-import { Plus } from '@sim/emcn'
+import { Plus, toast } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
 import { isOrgAdminRole } from '@sim/platform-authz/predicates'
 import { getErrorMessage } from '@sim/utils/errors'
@@ -305,6 +305,8 @@ export function TeamManagement({
 
       if (result.left) {
         window.location.href = APP_ENTRY_PATH
+      } else if (result.warning) {
+        toast.warning(`Ownership transferred. ${result.warning}`)
       }
     } catch (error) {
       logger.error('Failed to transfer ownership', error)
 
@@ -19,9 +19,13 @@ async function loadRuntime() {
       import('@/ee/scim/lib/managed-membership'),
       import('@/ee/scim/lib/entitlement'),
     ])
-  const [{ removeOrganizationMemberRecord }, { transferOrganizationOwnership }] = await Promise.all(
-    [import('@/lib/organizations/member-manager'), import('@/lib/billing/organizations/membership')]
-  )
+  const [
+    { removeOrganizationMemberRecord },
+    { removeUserFromOrganization, transferOrganizationOwnership },
+  ] = await Promise.all([
+    import('@/lib/organizations/member-manager'),
+    import('@/lib/billing/organizations/membership'),
+  ])
   return {
     db,
     schema,
@@ -31,6 +35,7 @@ async function loadRuntime() {
     sql,
     alias,
     removeOrganizationMemberRecord,
+    removeUserFromOrganization,
     transferOrganizationOwnership,
     ...membership,
     ...entitlement,
@@ -291,18 +296,36 @@ describe('SCIM managed membership in PostgreSQL', () => {
       return row?.role
     }
 
-    it('refuses a managed owner transferring to leave, leaving ownership unchanged', async () => {
-      const { transferOrganizationOwnership } = runtime
+    it('transfers a managed owner’s ownership but keeps them as admin when they try to leave', async () => {
+      const { db, schema, and, eq, transferOrganizationOwnership, removeUserFromOrganization } =
+        runtime
       await expect(
         transferOrganizationOwnership({
           organizationId: orgId,
           currentOwnerUserId: managedUserId,
           newOwnerUserId: adminUserId,
-          currentOwnerLeaves: true,
         })
-      ).resolves.toMatchObject({ success: false, refusalCode: 'SCIM_MANAGED_MEMBERSHIP' })
-      expect(await roleOf(managedUserId)).toBe('owner')
-      expect(await roleOf(adminUserId)).toBe('member')
+      ).resolves.toMatchObject({ success: true })
+      const [previousOwner] = await db
+        .select({ id: schema.member.id })
+        .from(schema.member)
+        .where(
+          and(eq(schema.member.organizationId, orgId), eq(schema.member.userId, managedUserId))
+        )
+      await expect(
+        removeUserFromOrganization({
+          userId: managedUserId,
+          organizationId: orgId,
+          memberId: previousOwner.id,
+          actorUserId: managedUserId,
+        })
+      ).resolves.toMatchObject({
+        success: false,
+        refusalCode: 'SCIM_MANAGED_MEMBERSHIP',
+        error: expect.stringContaining('Ask your identity provider administrator'),
+      })
+      expect(await roleOf(managedUserId)).toBe('admin')
+      expect(await roleOf(adminUserId)).toBe('owner')
     })
 
     it('lets a managed owner transfer ownership and stay', async () => {
 
@@ -535,6 +535,8 @@ export interface RemoveMemberParams {
 export interface RemoveMemberResult {
   success: boolean
   error?: string
+  /** Set when policy refused the removal, as opposed to it failing. */
+  refusalCode?: ForbiddenDetailCode
   /**
    * Whether the member row was actually deleted. `false` (with `success: true`)
    * when `requireNoOrgWorkspaceAccess` was set and the user still had workspace
@@ -1621,6 +1623,15 @@ export async function removeUserFromOrganization(
       return { success: false, error: error.message, billingActions, stoppedRuns: [] }
     }
     if (onError === 'throw') throw error
+    if (error instanceof ForbiddenOperationError) {
+      return {
+        success: false,
+        error: error.message,
+        refusalCode: error.detailCode,
+        billingActions,
+        stoppedRuns: [],
+      }
+    }
 
     logger.error('Failed to remove user from organization', {
       userId,
@@ -1837,19 +1848,11 @@ export interface TransferOwnershipParams {
   organizationId: string
   currentOwnerUserId: string
   newOwnerUserId: string
-  /**
-   * The current owner leaves once the transfer commits. Their self-leave is
-   * vetted inside the transfer, so a leave the directory would undo refuses the
-   * transfer too instead of half-applying it.
-   */
-  currentOwnerLeaves?: boolean
 }
 
 export interface TransferOwnershipResult {
   success: boolean
   error?: string
-  /** Set when the transfer was refused by policy rather than failed. */
-  refusalCode?: ForbiddenDetailCode
   workspacesReassigned: number
   billedAccountReassigned: number
   overageMigrated: string
@@ -1859,7 +1862,7 @@ export interface TransferOwnershipResult {
 export async function transferOrganizationOwnership(
   params: TransferOwnershipParams
 ): Promise<TransferOwnershipResult> {
-  const { organizationId, currentOwnerUserId, newOwnerUserId, currentOwnerLeaves } = params
+  const { organizationId, currentOwnerUserId, newOwnerUserId } = params
 
   const result: TransferOwnershipResult = {
     success: false,
@@ -1892,12 +1895,6 @@ export async function transferOrganizationOwnership(
       if (!currentOwnerMember) {
         throw new Error('Current user is not the owner of this organization')
       }
-      if (currentOwnerLeaves)
-        await assertSelfLeaveNotScimManaged({
-          organizationId,
-          userId: currentOwnerUserId,
-          executor: tx,
-        })
 
       const [newOwnerMember] = await tx
         .select({ id: member.id, role: member.role })
@@ -2067,8 +2064,6 @@ export async function transferOrganizationOwnership(
 
     return { ...result, success: true }
   } catch (error) {
-    if (error instanceof ForbiddenOperationError)
-      return { ...result, error: error.message, refusalCode: error.detailCode }
     logger.error('Failed to transfer organization ownership', {
       organizationId,
       currentOwnerUserId,