> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/core-concepts/how-aohsync-works.md).

# How AOH Sync Works

AOH Sync reads identity data from your connected Source Systems, builds a normalized view of your workforce, and continuously keeps Microsoft Entra ID in sync — without manual intervention.

## The three-stage flow

Every sync follows the same path:

```
Source Systems  ──►  AOH Sync  ──►  Microsoft Entra ID
 (HR, directory,       (reads,          (provisions,
  REST, CSV)           resolves,         updates,
                       enriches)         deprovisions)
```

**Stage 1 — Ingest.** AOH Sync reads data from each connected Source System via a Connector. Connectors support HR platforms, database-backed systems, API-connected systems, and CSV or SFTP file feeds. Each Connector runs on a configurable schedule (or on demand) and fetches only the records that have changed since the last run.

**Stage 2 — Resolve.** Incoming records from all your sources are merged into a single, normalized Identity for each real person. If the same person exists in both your HR system and a secondary directory, AOH Sync matches them by a configurable join key and combines their attributes into one Identity. When two sources supply the same attribute, a priority order you control decides which value wins.

**Stage 3 — Provision.** AOH Sync compares each Identity's current state against what Entra ID holds. It creates, updates, or disables Entra accounts to match — using only the permissions you granted during setup. No data is written to Entra that wasn't first reviewed through your attribute mappings.

{% hint style="info" %}
Your identity data never leaves your own Azure environment — AOH Sync runs entirely inside your subscription and does not send your identity data to any external service.
{% endhint %}

## Sync vs. provisioning

These two terms describe different directions of data movement:

* **Sync** pulls data *in*. AOH Sync reads from your Source and Target Systems and updates its Identity graph to reflect reality. For Entra ID, this uses delta queries so only changes come over.
* **Provisioning** pushes data *out*. AOH Sync writes the resolved Identity picture to a Target System so that access matches intent.

Both can run on a schedule or be triggered manually.

## What triggers a sync

| Trigger             | When it runs                                                                                                |
| ------------------- | ----------------------------------------------------------------------------------------------------------- |
| Scheduled full sync | On the schedule you configure per Connector                                                                 |
| Incremental sync    | After a full sync, picks up changes since the last run                                                      |
| Delta sync          | Near-real-time; detects only the specific attributes that changed within a record — the most efficient mode |
| Manual trigger      | On demand from the Connectors screen or via the API                                                         |

For a deeper explanation of each sync mode, see [Sync Types](/core-concepts/sync-types.md).

## Long-running work

Full syncs and provisioning runs operate in the background. The interface returns immediately when you trigger one; you can track progress and results from the Connectors sync history or the Status & Logs screen.

## Related

* [Source & Target Systems](/core-concepts/source-and-target-systems.md)
* [Identities, Accounts & Users](/core-concepts/identities-accounts-users.md)
* [Sync Types](/core-concepts/sync-types.md)
* [Provisioning & Deprovisioning Lifecycle](/core-concepts/provisioning-lifecycle.md)
* [What is AOH Sync?](/readme/what-is-aohsync.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/core-concepts/how-aohsync-works.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.