Change on AD server is not synchronized to Cloud Identity Engine(CIE)

• Active Directory (AD) changes made are not reliably syncing with Cloud Identity Engine (CIE).
• Object updates made are often delayed or completely unreflected in CIE.

• Prisma Access(SASE)
• Cloud Identity Engine(CIE)

• CIE does occasional maintenance during which all incremental syncs are suspended.
• After this maintenance is finished, incremental sync will be resumed.

The Cloud Identity Engine (CIE) supports both full and incremental synchronizations to ensure your directory attributes are up to date across your enforcement points.

Synchronize All Attributes (Full Sync)

A Full Sync is a complete synchronization of the entire directory. It is recommended if you lose connectivity, experience issues after a maintenance window, or need to ensure a complete snapshot of the directory is available

1. Log in to the Hub and open the Cloud Identity Engine app
2. Navigate to Directories and select the directory instance you wish to sync
3. Select Actions and then Full Sync to initialize the process immediately
4. Confirm the synchronization has started via the "Sync started" message. You must wait at least 90 seconds after completion before initiating another full sync

Note: For on-premises Active Directory, ensure all agents and domains for the tenant are active before starting the sync

Synchronize Directory Changes (Sync Changes)

Sync Changes (incremental sync) queries only the changes made since the last successful synchronization. This process is significantly faster than a full sync and occurs automatically every five minutes by default for supported directories

1. Log in to the Cloud Identity Engine app and navigate to Directories
2. Select Actions and then Sync Changes to propagate updates immediately
3. For on-premises Active Directory, click Sync Changes to start the process

Directory-Specific Behaviors

• Google Directory: Manual "Sync Changes" is not supported. Instead, you can manually set a synchronization interval of 6, 12, or 24 hours (default) by clicking Sync Every: on the Directories page
• Azure AD & Okta: CIE automatically syncs user and group attributes every five minutes. Azure AD device syncs typically occur daily
• SCIM Connector: Setup is not considered complete until an initial Full Sync is successfully performed after the Identity Provider (IdP) configuration is finished