If an employee's state differs between AD and Entra ID, name exactly what differs before calling it a synchronization problem.
A department attribute, account status, group assignment, and observed sign-in are different kinds of evidence. They may not describe the same thing at the same moment.
Identify where the information should be managed, inspect the connecting process, and check the actual access outcome. Neither console alone necessarily answers the whole question.
Record the specific disagreement and the behavior it affects
Replace “AD and Entra are out of sync” with a precise observation.
| Observation | Question to investigate |
|---|---|
| Different department values | Where should this attribute be managed and updated? |
| Different enabled/disabled state | What process should carry the relevant change? |
| Missing group assignment | Which assignment and object are being compared? |
| Access differs from the visible state | Which authentication, session, or application behavior is involved? |
These are starting questions, not diagnoses. Use authorized tools to record the object, attribute, timing, and observed behavior. Keep personal information and internal identifiers out of public portfolio notes.
A precise description makes the next check useful. It also prevents you from changing synchronization settings to fix what may instead be a different source-of-authority, assignment, or session issue.
Determine the intended source of the information
In the supported configuration, which system owns the relevant change?
Do not assume that a field visible in both directories can be maintained independently in either place. The configured source and synchronization rules matter.
Microsoft's hybrid identity overview provides a starting point for the available relationships, but your investigation must match the actual deployment.
Changing both sides at once can obscure the cause and create new inconsistency. Establish the intended path before correcting the value.
Inspect the process expected to carry the change
Check the relevant synchronization or provisioning evidence, supported configuration, and recent changes.
Was the object included? Did the process report an error? Is the expected attribute mapping appropriate? What does the destination currently show?
Avoid assuming a universal delay or promising that waiting a fixed number of minutes will solve every case. Use the observed state and the product's current guidance.
The goal is to identify whether the change is absent, delayed, rejected, or not expected under the configured rules.
Separate identity data from authentication and sessions
A directory-state change doesn't automatically describe every active application session.
The sign-in path, application integration, and session behavior may require separate investigation. Microsoft discusses those distinctions in its access-revocation guidance.
For a departure or security-related case, follow the organization's approved process rather than assuming one console action ends every access path.
Be precise about what has been verified and which applications or sessions remain outside the current evidence.
Reproduce only the relevant relationship in a lab
Use fictional identities and a supported isolated setup.
Choose one attribute or access change, record the intended source, observe the connecting process, and verify the destination and user outcome that your lab actually supports.
If you cannot reproduce the full production design, state the difference. A smaller model can still teach the concept without being presented as an identical environment.
Use a directory-synchronization explanation to make the flow understandable to someone who hasn't seen your setup.
Document the resolution as a path, not a magic fix
Your final note should connect the original discrepancy, the evidence, the correction, and the verified result.
Include the limit of the conclusion. Fixing one attribute mapping does not prove every lifecycle event works. Disabling one account does not by itself prove every separate application session ended.
That careful explanation is useful career evidence because it shows you understand the system boundaries.
The Six-Figure IAM Career Playbook helps connect existing directory experience to practical IAM projects and a more focused role target. The $9 guide includes three lab directions and a 90-day plan.
When two identity systems appear to disagree, follow the specific data and access paths. The useful skill is knowing which relationship to investigate and what evidence would establish the intended outcome.