Attestation Deny Decision doesn't remove the Ad Group membership from employee

Are we certain that the ADSGroups are assigned directly and not indirect. For example via an ITShop request or a business role. Anything showing in system journal or the dbqueue for this attestation?

AD Groups are assigned through both ITShop requests and Business role. 

Only the below events are triggering when I deny the attestation. 

If you look at the message in the history of the attestation case, you will see that the removal of these types of memberships is disabled.

Please check the documentation on how to configure the removal of these types.

https://support.oneidentity.com/technical-documents/identity-manager/8.2.1/attestation-administration-guide/41#TOPIC-1794577

In my use case, AD Groups are assigning based on the department.

As we can look at the below message in the history of the attestation case. it's deleting the primary department from the employee and deleting all groups from the employee, not specific groups.

Please also have a look at the Configuration Parameter

The system has to remove the source of the inheritance that is the only way to remove an indirect ADSGroup membership. The user in this case only got the ADSGroup because they were a member of a specific department. The only way to remove the group is to remove the user from the department.