Full sync is a complete synchronisation run between an identity source and a target system. It reads the full data set, then creates, updates, disables or removes accounts and entitlements according to the configured matching and reconciliation rules.
What Full Sync Means in Identity Synchronisation
Full sync is the most complete form of directory or identity synchronisation. It does not rely only on recent changes, it reprocesses the full dataset so the target can be brought back into alignment with the source of truth under the current matching and reconciliation rules.
That makes full sync a baseline reconciliation mechanism as well as an update mechanism. It is commonly used when a target system needs a clean re-evaluation of accounts, entitlements, lifecycle states, or mapping logic after drift, missed deltas, or rule changes.
How Full Sync Differs from Incremental Synchronisation
Incremental synchronisation is optimised for speed and usually processes only deltas. Full sync is broader: it scans everything, which makes it slower but more authoritative when the goal is completeness rather than efficiency. In practice, the two modes serve different operational needs, not competing purposes.
Because full sync reads the whole dataset, it can reveal discrepancies that delta processing would miss, such as stale accounts, inconsistent entitlement assignments, or records that were never cleanly captured by change tracking. That also means the run can be more disruptive to capacity, timing, and downstream dependencies than a delta-only cycle.
What a Full Sync Changes in the Target System
A full sync can create new accounts, update attributes, disable stale access, and remove entries that no longer meet reconciliation rules. Its effect depends on the connector and policy model, but the key point is that it recalculates state against the authoritative source rather than only replaying recent mutations.
This is why matching rules matter so much. If the rules are too loose, a full sync can merge the wrong records or propagate bad data at scale. If the rules are too strict, it can fail to match legitimate identities and leave orphaned or duplicate access behind.
Why Full Sync Matters Operationally
Full sync is often used to recover from drift, validate a connector after changes, or re-establish confidence after an outage or data-quality issue. It is also a common tool when organisations need a clean reconciliation pass after changing business rules, source attributes, or target-side schema.
Because it touches the entire population, it can surface hidden dependency problems quickly. A run may expose missing identifiers, inconsistent entitlement logic, or latent performance constraints that only appear when the system is forced to process every object rather than a small update set.
Risk and Threat Considerations
Full sync can amplify both data-quality mistakes and access-control mistakes because it re-applies them across the whole population. If the source feed, matching logic, or reconciliation rules are wrong, the run can propagate the error at scale and create widespread account disruption or privilege drift.
Failure mechanism: A bad source attribute, incorrect correlation rule, or stale entitlement mapping is processed as authoritative for every record, so the synchronisation run can disable valid access, reintroduce removed access, or create duplicate identities and orphaned entitlements.
Impact: The result can be broad availability loss, excessive access, audit inconsistency, and a longer recovery window because the damage is distributed across many accounts and downstream systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Full sync often reconciles credentials and access state across systems. |
| AC-2 — Account Management | Full sync creates, updates, disables, and removes accounts based on authoritative rules. | |
| AC-6 — Least Privilege | Reconciliation rules can overgrant or undergrant entitlements during a full resync. | |
| Recommendation — Reconcile credential lifecycle changes so stale authentication material is disabled or removed. Use account management controls to keep target accounts aligned with source-of-truth status. Review entitlement mappings to prevent excess access from being re-applied during reconciliation. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Full sync depends on knowing which systems and identities must be reconciled. |
| PR.AA-05 — Assets are managed to ensure proper authentication and authorization | Full sync directly enforces authentication and authorization state across the target. | |
| Recommendation — Maintain an accurate inventory of connected identity sources and target systems before reconciling them. Align authentication and authorization state with the authoritative identity source during synchronization. | ||
Practitioner Guidance
Why practitioners should care: Full sync is not just a maintenance job, it is a governance-sensitive reconciliation event. Treat it as a controlled operation whenever the connected population is large, the matching rules are immature, or the target system has downstream business impact.
What to watch for: Repeated full-sync dependence often signals that incremental change tracking, source data quality, or reconciliation design is not dependable enough. When that happens, the sync mode becomes a symptom of underlying control weakness rather than a routine choice.
Related resources from NHI Mgmt Group
- What is the difference between a full state sync and low-latency event feeds for SaaS identity governance?
- How do organisations decide whether to use incremental sync or full polling?
- When should IAM teams prioritise filtered incremental sync over full directory sync?
- How does OneDrive auto-sync create secrets exposure in SharePoint?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org