> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Manage directory synchronization Directory synchronization keeps your IDaaS user directory in sync with your corporate directory (Active Directory, Microsoft Entra ID, LDAP, or AD Connector). When you configure directory synchronization, your corporate directory becomes the source of truth for user information. ## Key synchronization concepts - **Source of truth** Your directory is the authoritative source for user data. When a user is added, removed, or changed in the directory, those changes are automatically reflected in IDaaS. - **Password authentication** IDaaS performs password authentication against passwords managed in your directory, ensuring consistent identity verification across systems. - **Synchronization scheduling** Synchronization can be performed: - **Automatically** on a configured interval (default behavior). - **On-demand** by an administrator when immediate updates are needed. - **Attribute mapping** Directory synchronization configuration specifies which directory attributes map to which IDaaS user attributes, allowing you to customize which information is synchronized. - **Selection criteria** Synchronization can be configured to select which users are synchronized based on: - Search base membership - Group membership ## Synchronization modes Synchronization can run in two distinct modes: - [Full synchronization](#full-synchronization) - [Delta synchronization](#delta-synchronization) ### Full synchronization All users in the directory that match your selection criteria are checked against what is currently stored in IDaaS. Any users that have changed are updated in IDaaS. Full synchronization is comprehensive but more resource-intensive. ### Delta synchronization Only users that have changed in the directory since the last synchronization are considered. Delta synchronization is faster and has less performance impact on your customer directory. note By default, IDaaS performs delta synchronizations. important Most configuration changes in IDaaS (such as attribute mappings, object class mappings, and desynchronization policies) do not cause the directory entries themselves to change. For these cases, the administrator should run a full synchronization after such configuration changes to ensure all users are updated correctly. Prerequisite: Active Directory permissions Before enabling delta synchronization, configure the following permissions in Active Directory. The Active Directory service account used by the Directory Sync Agent requires the following extended rights on each domain naming-context root queried by the agent, for example `DC=example,DC=com`: - **Replicating Directory Changes** for the DirSync control. - **Replicating Directory Changes All** for incremental group membership values. These permissions must be granted in Active Directory to use delta sync. Standard LDAP read permissions alone are not sufficient. Grant the rights to the agent service account at the domain root; do not grant them separately on configured OUs, subtrees, users, or groups. DirSync reads changes from the domain partition root and the agent filters the results to the configured search bases afterward. If the agent synchronizes multiple domains, grant both rights on every domain naming-context root it queries. Full crawl mode does not require these replication permissions. In **Active Directory Users and Computers**, enable **Advanced Features**, open the domain root's properties, and use the **Security** tab to add the agent service account and allow both extended rights. ## Force sync Use Force sync when you want to synchronize directory changes immediately instead of waiting for the next scheduled synchronization. Force sync is supported for all directory types, including on-premises Active Directory, on-premises LDAP, and Microsoft Entra ID. For on-premises directories, the **Crawl Frequency** setting defines how often directory information is synchronized. The default interval is 1 hour. For Microsoft Entra ID, automatic synchronization occurs every 8 hours. For on-premises directories, if you set the crawl frequency to `0`, automatic crawling is disabled and Force sync is not available. For Microsoft Entra ID, you must wait for the current synchronization to finish before starting another one. Synchronization of users from Microsoft Entra ID supports synchronizing the Security ID value into IDaaS. The Security ID uniquely identifies users in a Microsoft Windows environment. ## Delta sync and full sync for Active Directory For Active Directory directories, scheduled sync runs use Delta sync by default. Delta sync processes only changed objects, which makes scheduled sync runs faster and reduces LDAP and network load. If you change the directory configuration, run a Force sync in **Full** mode. Use the following sync types for on-premises Active Directory directories: - **Full** runs a complete resynchronization, which is useful after configuration changes. - **Delta** continues incremental synchronization from the current checkpoint. If a user is skipped because mandatory attributes or other requirements are missing, update that user in Active Directory and let a later Delta sync process the change. Run a **Full** sync when the condition requires a complete recrawl, such as when entitlements were missing. ### Run a Force Sync 1. Click Menu icon **>** **Resources > Directories**. The **Directories List** page appears. 2. Click Refresh CW icon to the right of the directory you want to synchronize. The **Force Synchronize** dialog box appears. 3. If applicable, select the **Synchronization Type**. note For on-premises Active Directory directories, Force sync supports both full and Delta sync. Delta sync is the default. - Use **Full** when you need to run a complete resync, such as after configuration changes. - Use **Delta** when you want to continue incremental synchronization from the current checkpoint. 4. Click **Force synchronization**. The update takes approximately 10 seconds to complete. 5. Optional. Click Eye icon to view the **Directory Sync Details**. - For Microsoft Entra ID, the **Directory Sync Details** provides a list of **Most Recent Errors** (to a maximum of 20 errors) and the **Sync Results**. - For on-premises directories, the **Directory Sync Details** provides a list of **Most Recent Errors** (to a maximum of 20 errors) and the **Directory Scan Results**. 6. Click Chevron Down icon to see more information on Most Recent Errors. 7. Click Chevron Down icon to see more information on the Directory Scan (on-premises directory) or Sync Details (Microsoft Entra ID). The following synchronization metrics for Users and Groups appear: - **New.** New users or groups that were added during crawling - **Changed.** Users and groups that have changes since the last crawl - **Desynced.** Users and groups that are no longer present in the directory and have been removed - **Failed.** Number of unexpected errors while crawling users and groups - **Unchanged.** Users and groups that have not changed since the last crawl note Metrics only reflect the statistics during the crawl phase. 8. Click Chevron Down icon to see the **Upload Results**. The Upload Results shows the metrics for new, changed, desynced and failed results of the synchronization for Users and Groups of on-premises directories only. note This metric is not available for Microsoft Entra ID directories. 9. Click **OK** to close the **Directory Sync Details**.