diff --git a/internal/server/data/provideruser.go b/internal/server/data/provideruser.go
index 540785d83a..8b61ca5df3 100644
--- a/internal/server/data/provideruser.go
+++ b/internal/server/data/provideruser.go
@@ -113,8 +113,9 @@ func ListProviderUsers(tx ReadTxn, providerID uid.ID, p *SCIMParameters) ([]mode
 		if p.Count != 0 {
 			query.B("LIMIT ?", p.Count)
 		}
-		if p.StartIndex != 0 {
-			query.B("OFFSET ?", p.StartIndex)
+		if p.StartIndex > 0 {
+			offset := p.StartIndex - 1 // start index begins at 1, not 0
+			query.B("OFFSET ?", offset)
 		}
 	}
 
diff --git a/internal/server/data/provideruser_test.go b/internal/server/data/provideruser_test.go
index efdeabfb2e..92dbf4ea07 100644
--- a/internal/server/data/provideruser_test.go
+++ b/internal/server/data/provideruser_test.go
@@ -322,9 +322,9 @@ func TestListProviderUsers(t *testing.T) {
 				err := CreateProvider(tx, provider)
 				assert.NilError(t, err)
 
-				_ = createTestProviderUser(t, tx, provider, "david@example.com")
-				pu := createTestProviderUser(t, tx, provider, "lucy@example.com")
-				return provider.ID, &SCIMParameters{StartIndex: 1}, []models.ProviderUser{pu}, 2
+				pu1 := createTestProviderUser(t, tx, provider, "david@example.com")
+				pu2 := createTestProviderUser(t, tx, provider, "lucy@example.com")
+				return provider.ID, &SCIMParameters{StartIndex: 1}, []models.ProviderUser{pu1, pu2}, 2
 			},
 		},
 	}