Under the 'Password Sync' tab you have the following options:
Force synchronization of passwords across all linked accounts: This setting, when enabled, will synchronize users' password across all their linked accounts.
Say, a user has linked his Google Apps, Office 365 and IBM AS400 accounts for password synchronization. Now, when a user resets his Active Directory password or password of any other account, the new password will be automatically synchronized across Google Apps, Office 365, IBM AS400 and Active Directory. The user cannot deselect linked accounts during password reset or change password.
Allow users to deselect Active Directory during reset/unlock operations: This setting, when enabled, will allow users to deselect Active Directory from the list of accounts available for password synchronization and reset password for his non-Windows accounts alone.
By default, whenever a user opts for self password reset of his non-Windows account, the new password will be automatically synchronized with Active Directory. With this setting enabled, the user can opt-out of synchronizing his password with Active Directory.
Run custom script to synchronize password with other providers: This setting enables you to run a custom script that synchronizes users' password with any custom provider of your choice.
Run custom script to synchronize account lockout status with other providers: This setting enables you to run a custom script that synchronizes users' account lockout status with any custom provider of your choice.
Hide the Application tab in the user portal.
Select this option to hide the Application tab when automatic account-linking option is enabled for users with no access to any enterprise application for SAML SSO.
Say you choose to automate user account linking process, but also want users to only utilize password sync for specific applications. In this case you can select this option and hide the Application tab to users.