SharePoint Site Groups are not properly tokenized

I'm working on a solution to get a generic template from a template site collection. This template is going to be applied to another (newly created) site collection.

The process works ok so far.

At the moment I'm stuck with the following issue.

My template contains information about the default groups of the template site. These groups are added to the target site and do not replace the default groups in the target.

Below is the first part of my template that holds the information about the SiteGroups.

<?xml version="1.0" encoding="utf-8"?>
<pnp:Provisioning xmlns:pnp="http://schemas.dev.office.com/PnP/2022/09/ProvisioningSchema">
  <pnp:Preferences Generator="PnP.Framework, Version=1.11.2.0, Culture=neutral, PublicKeyToken=0d501f89f11b748c" />
  <pnp:Templates ID="CONTAINER-TEMPLATE-5BCBEB7FE72E4E5B9676670DBF3B763D">
    <pnp:ProvisioningTemplate ID="TEMPLATE-5BCBEB7FE72E4E5B9676670DBF3B763D" Version="1" BaseSiteTemplate="SITEPAGEPUBLISHING#0" Scope="RootSite">
      <pnp:WebSettings RequestAccessEmail="" NoCrawl="false" WelcomePage="SitePages/Home.aspx" SiteLogo="" AlternateCSS="" MasterPageUrl="{masterpagecatalog}/seattle.master" CustomMasterPageUrl="{masterpagecatalog}/seattle.master" CommentsOnSitePagesDisabled="false" QuickLaunchEnabled="true" HorizontalQuickLaunch="true" SearchScope="DefaultScope" SearchBoxInNavBar="Inherit" />
      <pnp:SiteSettings AllowDesigner="true" SearchBoxInNavBar="Inherit" SearchCenterUrl="" />
      <pnp:RegionalSettings AdjustHijriDays="0" AlternateCalendarType="None" CalendarType="Gregorian" Collation="25" FirstDayOfWeek="Monday" FirstWeekOfYear="0" LocaleId="1031" ShowWeeks="false" Time24="true" TimeZone="4" WorkDayEndHour="5:00PM" WorkDays="62" WorkDayStartHour="8:00AM" />
      <pnp:SupportedUILanguages>
        <pnp:SupportedUILanguage LCID="1031" />
        <pnp:SupportedUILanguage LCID="1036" />
      </pnp:SupportedUILanguages>
      <pnp:Security AssociatedOwnerGroup="Besitzer von TEMPLATE" AssociatedMemberGroup="Mitglieder von TEMPLATE" AssociatedVisitorGroup="Besucher von TEMPLATE">
<pnp:SiteGroups>
          <pnp:SiteGroup Title="Besitzer von TEMPLATE" Description="Mithilfe dieser Gruppe können Sie Personen Vollzugriff für die folgende SharePoint-Website erteilen&amp;#58; &lt;a href=&quot;/sites/TEMPLATE&quot;&gt;TEMPLATE&lt;/a&gt;" Owner="{associatedownergroupid}" AllowMembersEditMembership="false" AllowRequestToJoinLeave="false" AutoAcceptRequestToJoinLeave="false" OnlyAllowMembersViewMembership="false" RequestToJoinLeaveEmailSetting="" />
          <pnp:SiteGroup Title="Besucher von TEMPLATE" Description="Mithilfe dieser Gruppe können Sie Personen Leseberechtigungen für die folgende SharePoint-Website erteilen&amp;#58; &lt;a href=&quot;/sites/TEMPLATE&quot;&gt;TEMPLATE&lt;/a&gt;" Owner="{associatedownergroupid}" AllowMembersEditMembership="false" AllowRequestToJoinLeave="false" AutoAcceptRequestToJoinLeave="false" OnlyAllowMembersViewMembership="false" RequestToJoinLeaveEmailSetting="" />
          <pnp:SiteGroup Title="Mitglieder von TEMPLATE" Description="Mithilfe dieser Gruppe können Sie Personen Mitwirkungsberechtigungen für die folgende SharePoint-Website erteilen&amp;#58; &lt;a href=&quot;/sites/TEMPLATE&quot;&gt;TEMPLATE&lt;/a&gt;" Owner="{associatedownergroupid}" AllowMembersEditMembership="false" AllowRequestToJoinLeave="false" AutoAcceptRequestToJoinLeave="false" OnlyAllowMembersViewMembership="false" RequestToJoinLeaveEmailSetting="" />

The three default groups of my template site collection are stored and used in the template. They hold permissions and other information.

I would expect that PnP would use the default groups of the target site to replace these three within the template. At the moment, the previous default groups are added to the target site.

Start by tracing the provisioning engine's handling of the pnp:Security and pnp:SiteGroups elements shown in the template, focusing on how associated groups are matched on the target site. Done when applying the template reuses the target site's three default groups instead of creating additional groups, while preserving their permissions and related settings.