Skip to main content

Manage directory synchronization

Directory synchronization keeps your IDaaS user directory in sync with your corporate directory (Active Directory, Microsoft Entra ID, LDAP, or AD Connector). When you configure directory synchronization, your corporate directory becomes the source of truth for user information.

Key synchronization concepts​

  • Source of truth

    Your directory is the authoritative source for user data. When a user is added, removed, or changed in the directory, those changes are automatically reflected in IDaaS.

  • Password authentication

    IDaaS performs password authentication against passwords managed in your directory, ensuring consistent identity verification across systems.

  • Synchronization scheduling

    Synchronization can be performed:

    • Automatically on a configured interval (default behavior).
    • On-demand by an administrator when immediate updates are needed.

  • Attribute mapping

    Directory synchronization configuration specifies which directory attributes map to which IDaaS user attributes, allowing you to customize which information is synchronized.

  • Selection criteria

    Synchronization can be configured to select which users are synchronized based on:

    • Search base membership
    • Group membership

Synchronization modes​

Synchronization can run in two distinct modes:

Full synchronization​

All users in the directory that match your selection criteria are checked against what is currently stored in IDaaS. Any users that have changed are updated in IDaaS. Full synchronization is comprehensive but more resource-intensive.

Delta synchronization​

Only users that have changed in the directory since the last synchronization are considered. Delta synchronization is faster and has less performance impact on your customer directory.

note

By default, IDaaS performs delta synchronizations.

important

Most configuration changes in IDaaS (such as attribute mappings, object class mappings, and desynchronization policies) do not cause the directory entries themselves to change. For these cases, the administrator should run a full synchronization after such configuration changes to ensure all users are updated correctly.

Prerequisite: Active Directory permissions

Before enabling delta synchronization, configure the following permissions in Active Directory.

The Active Directory service account used by the Directory Sync Agent requires the following extended rights on each domain naming-context root queried by the agent, for example DC=example,DC=com:

  • Replicating Directory Changes for the DirSync control.
  • Replicating Directory Changes All for incremental group membership values.

These permissions must be granted in Active Directory to use delta sync. Standard LDAP read permissions alone are not sufficient. Grant the rights to the agent service account at the domain root; do not grant them separately on configured OUs, subtrees, users, or groups. DirSync reads changes from the domain partition root and the agent filters the results to the configured search bases afterward. If the agent synchronizes multiple domains, grant both rights on every domain naming-context root it queries. Full crawl mode does not require these replication permissions.

In Active Directory Users and Computers, enable Advanced Features, open the domain root's properties, and use the Security tab to add the agent service account and allow both extended rights.

Force sync​

Use Force sync when you want to synchronize directory changes immediately instead of waiting for the next scheduled synchronization. Force sync is supported for all directory types, including on-premises Active Directory, on-premises LDAP, and Microsoft Entra ID.

For on-premises directories, the Crawl Frequency setting defines how often directory information is synchronized. The default interval is 1 hour. For Microsoft Entra ID, automatic synchronization occurs every 8 hours.

For on-premises directories, if you set the crawl frequency to 0, automatic crawling is disabled and Force sync is not available. For Microsoft Entra ID, you must wait for the current synchronization to finish before starting another one.

Synchronization of users from Microsoft Entra ID supports synchronizing the Security ID value into IDaaS. The Security ID uniquely identifies users in a Microsoft Windows environment.

Delta sync and full sync for Active Directory​

For Active Directory directories, scheduled sync runs use Delta sync by default. Delta sync processes only changed objects, which makes scheduled sync runs faster and reduces LDAP and network load.

If you change the directory configuration, run a Force sync in Full mode.

Use the following sync types for on-premises Active Directory directories:

  • Full runs a complete resynchronization, which is useful after configuration changes.
  • Delta continues incremental synchronization from the current checkpoint.

If a user is skipped because mandatory attributes or other requirements are missing, update that user in Active Directory and let a later Delta sync process the change. Run a Full sync when the condition requires a complete recrawl, such as when entitlements were missing.

Run a Force Sync​

  1. Click > Resources > Directories. The Directories List page appears.

  2. Click to the right of the directory you want to synchronize. The Force Synchronize dialog box appears.

  3. If applicable, select the Synchronization Type.

    note

    For on-premises Active Directory directories, Force sync supports both full and Delta sync. Delta sync is the default.

    • Use Full when you need to run a complete resync, such as after configuration changes.
    • Use Delta when you want to continue incremental synchronization from the current checkpoint.

  4. Click Force synchronization. The update takes approximately 10 seconds to complete.

  5. Optional. Click to view the Directory Sync Details.

    • For Microsoft Entra ID, the Directory Sync Details provides a list of Most Recent Errors (to a maximum of 20 errors) and the Sync Results.
    • For on-premises directories, the Directory Sync Details provides a list of Most Recent Errors (to a maximum of 20 errors) and the Directory Scan Results.

  6. Click to see more information on Most Recent Errors.

  7. Click to see more information on the Directory Scan (on-premises directory) or Sync Details (Microsoft Entra ID). The following synchronization metrics for Users and Groups appear:

    • New. New users or groups that were added during crawling
    • Changed. Users and groups that have changes since the last crawl
    • Desynced. Users and groups that are no longer present in the directory and have been removed
    • Failed. Number of unexpected errors while crawling users and groups
    • Unchanged. Users and groups that have not changed since the last crawl
    note

    Metrics only reflect the statistics during the crawl phase.

  8. Click to see the Upload Results. The Upload Results shows the metrics for new, changed, desynced and failed results of the synchronization for Users and Groups of on-premises directories only.

    note

    This metric is not available for Microsoft Entra ID directories.

  9. Click OK to close the Directory Sync Details.