The Sync Lag Nobody Planned For

Hybrid identity means an account lives in two places at once. On-prem Active Directory holds one copy. Entra ID holds another. A connector running on its own schedule keeps the two in sync.

Most of the time, nobody thinks about that schedule. It only becomes visible the moment it lags.

Where the Gap Shows Up

Disable someone in AD and the sync cycle has not run yet, and Entra still shows them active. Cloud apps behind Entra keep authenticating them. Update a group membership on one side and the other side is stale until the next pass. Nobody planned for that window. It is just how a two-directory system with a delay between them behaves.

The default sync interval for Entra Connect is 30 minutes. In practice, that means there is a window of up to 30 minutes where the two directories disagree about the state of any given account. For most day-to-day operations, that window is invisible. For offboarding, it is the gap where access persists after someone has been told it was revoked.

That is not a sync failure. The connector did exactly what it was built to do, on its own schedule. What fails is the assumption that "disabled" means disabled everywhere, immediately.

Why Offboarding Checklists Miss This

Most offboarding checklists reference one directory or the other. Disable the AD account. Revoke licenses in Entra. Remove group memberships. Each step checks one side of the system and calls that step done.

The problem is sequencing. If the checklist disables AD first and checks Entra second, the Entra check might return stale data if the sync has not run. The account looks active. The person running the checklist either waits (if they know about the lag) or assumes the system will catch up (if they do not).

In environments where offboarding is time-sensitive, that assumption creates a window where a terminated employee still has active cloud sessions. Conditional Access policies that rely on account status in Entra will not block them until the sync propagates the disable.

What Actually Fixes This

The fix is rarely a bigger tool. It is usually just knowing the lag exists and building the offboarding steps around it instead of assuming both directories move at the same speed.

Document the sync interval. If the default is 30 minutes, write that down somewhere the offboarding team can see it. In most environments this information is tribal knowledge held by whoever set up the connector. Making it explicit changes how the team plans their timing.

Verify both sides independently. After disabling in AD, wait for the sync to run and then confirm the Entra state. If the offboarding is urgent enough that a 30-minute wait is not acceptable, use Entra directly to revoke sessions and disable the cloud account separately rather than waiting for sync to propagate.

Consider forcing a sync for high-priority offboardings. Entra Connect supports manual delta syncs that can be triggered on demand. For routine departures, waiting for the next scheduled cycle is fine. For involuntary terminations where immediate access revocation matters, triggering a manual sync closes the gap.

Check session tokens, not just account status. Disabling an account does not automatically kill active sessions in all cloud apps. Some applications cache tokens for hours. If the offboarding requires confirmed revocation, the process needs a step that explicitly revokes active sessions in addition to disabling the account.

The Underlying Problem

The real issue is not the sync lag itself. Thirty minutes is a reasonable interval for a connector that handles thousands of objects. The issue is that offboarding processes are often built on the assumption of instant consistency across systems, and hybrid identity does not work that way.

Every environment that runs Entra Connect has this gap. Whether it matters depends on how the offboarding process accounts for it. The connector is doing its job. The question is whether the process built around it knows that.