Sync Settings

    The Sync Settings tab controls how and how often a connected directory's users and groups flow into Universal Directory. You configure the synchronization schedule and the rules that govern the import: whether new accounts are created automatically or held for review, what happens to a Universal Directory account when its source is deleted, and which objects qualify to sync at all.

    Prerequisites

    • A directory must be connected on the Manage Directory page (for example, a Microsoft Entra ID tenant). Sync Settings configures an existing connection, so add the directory first if one is not yet set up.

    Configuration steps

    Navigate to Universal Directory > Manage Directory and select the Active Directory or Azure Active Directory tab. Click the advanced settings icon (icon-advanced-settings) and open the Sync Settings tab. Configure the options below, then click Save.

    The sync schedule can also be reached by clicking the scheduler icon (icon-scheduler) in the directory row and selecting Modify Scheduler.

    The scheduler applies to the full synchronization cycle. Object import rules are configured separately under the User and Group sub-tabs.

    Configure the scheduler

    Select Enable Scheduler, then choose a frequency:

    • Sync Daily: Use the hrs once drop-down menu to set how many hours between syncs.
    • Sync Weekly once on: Choose the day of the week and a time window for the sync to run.

    Configure user import (under the User sub-tab)

    Turn on Enable Users Import to Universal Directory, then set the rules for which users are imported and what happens to them during each sync:

    • Automatically create new User in Universal Directory when it is found in your Domain: When a newly synced user has no existing Universal Directory account, one is created automatically, without a review step.
    • Need Approval if following attributes Updated for the linked User Accounts: Holds changes to the selected attributes for approval before they sync. Use the Select Attributes field to choose which attributes this rule applies to.
    • Automatically Disable Universal Directory User, if the User is deleted in your Domain (Microsoft Entra ID only): When enabled, the linked Universal Directory account is automatically disabled or deleted when the source account is removed. Click the underlined word Disable in the setting label to switch the action: select Disable to deactivate the account while keeping it recoverable, or Delete to remove it permanently.
    • Enable the advanced filter to synchronize users based on specific criteria: When enabled, only users that match the defined conditions are synced. See Build an advanced filter below.

    Configure group import (under the Group sub-tab)

    Turn on Enable Groups Import to universal directory. Optionally, enable Enable the advanced filter to synchronize groups based on specific criteria to limit the sync to groups that match the defined conditions.

    Build an advanced filter

    The advanced filter condition area is always visible under the User and Group sub-tabs. It becomes active when the filter checkbox is enabled.

    To define filter conditions:

    1. Select the attribute to test (e.g., Object ID for users or Display Name for groups).
    2. Choose the matching condition (e.g., Is or Is Not).
    3. Enter the value to match.
    4. Click the add icon (icon-add) to add more conditions.
    5. Click + Add group to combine conditions into groups and control evaluation order. The Criteria Pattern shows the sequence in which conditions and groups are applied.

    Tips

    • The Disable or Delete action on source deletion lets offboarding flow through automatically: when an account is removed in the source directory, its Universal Directory account is disabled or deleted on the next sync with no manual cleanup. Choose Disable when a source deletion could be temporary or accidental, since it keeps the account recoverable, and choose Delete only when removal at the source should always remove the account from Universal Directory as well.
    • Enable Need Approval for the attributes that matter most, such as those that drive access or group membership, so changes coming from the source are reviewed before they reach Universal Directory instead of syncing automatically.