How AOH Sync Works
Last updated
AOH Sync reads identity data from your connected Source Systems, builds a normalized view of your workforce, and continuously keeps Microsoft Entra ID in sync — without manual intervention.
Every sync follows the same path:
Source Systems ──► AOH Sync ──► Microsoft Entra ID
(HR, directory, (reads, (provisions,
REST, CSV) resolves, updates,
enriches) deprovisions)Stage 1 — Ingest. AOH Sync reads data from each connected Source System via a Connector. Connectors support HR platforms, database-backed systems, API-connected systems, and CSV or SFTP file feeds. Each Connector runs on a configurable schedule (or on demand) and fetches only the records that have changed since the last run.
Stage 2 — Resolve. Incoming records from all your sources are merged into a single, normalized Identity for each real person. If the same person exists in both your HR system and a secondary directory, AOH Sync matches them by a configurable join key and combines their attributes into one Identity. When two sources supply the same attribute, a priority order you control decides which value wins.
Stage 3 — Provision. AOH Sync compares each Identity's current state against what Entra ID holds. It creates, updates, or disables Entra accounts to match — using only the permissions you granted during setup. No data is written to Entra that wasn't first reviewed through your attribute mappings.
Your identity data never leaves your own Azure environment — AOH Sync runs entirely inside your subscription and does not send your identity data to any external service.
These two terms describe different directions of data movement:
Sync pulls data in. AOH Sync reads from your Source and Target Systems and updates its Identity graph to reflect reality. For Entra ID, this uses delta queries so only changes come over.
Provisioning pushes data out. AOH Sync writes the resolved Identity picture to a Target System so that access matches intent.
Both can run on a schedule or be triggered manually.
Scheduled full sync
On the schedule you configure per Connector
Incremental sync
After a full sync, picks up changes since the last run
Delta sync
Near-real-time; detects only the specific attributes that changed within a record — the most efficient mode
Manual trigger
On demand from the Connectors screen or via the API
For a deeper explanation of each sync mode, see Sync Types.
Full syncs and provisioning runs operate in the background. The interface returns immediately when you trigger one; you can track progress and results from the Connectors sync history or the Status & Logs screen.
Last updated