Sync Strategy

Detecting upstream identity sources and declaring sync relationships between systems.

What is a Sync Strategy?

The Sync Strategy step in the onboarding wizard (vendor-gated) determines whether an upstream identity source exists that syncs into this system. For Entra, the standard question is: "Do you have an on-premises AD that syncs into this Entra tenant?"

The answer drives a filter on the imported objects: if you answer "yes", onPremisesSyncEnabled eq false is set as the $filter so that the platform does not try to provision what AD already manages (which would cause a race condition with Entra Connect Sync).

Connector Sync Relationships

Beyond the Sync Strategy step, you can explicitly declare in Systems → Connector Sync Relationships that system A is the source for system B with scope groups or identities. When a grant or revoke on B matches the declared patterns, the write action is routed as an IAM task to the source side instead of a direct write on B.

Use case: AD → Entra Connect Sync. Group memberships should be changed on the AD side; Entra picks them up through the sync.

Further reading:

• Reconciliation
• JML Flows
• Provisioning Mappings