If ldap_sync_last_sync_at is nil, then the LDAP group got into
an inconsistent state after the transition. Since it's possible
for ldap_sync_last_sync_at to be nil, we guard against this
occurrence and attempt to bubble up the error to the admin.