Hi There,
If I disable any account in on-premises DC, does this syncs immediately like passwords?
If not, how can I make sure it does?
Cheers,
NG
Hi There,
If I disable any account in on-premises DC, does this syncs immediately like passwords?
If not, how can I make sure it does?
Cheers,
NG
No, it syncs like any other attribute, 30 mins by default. You can force a sync as detailed here: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-feature-scheduler#start-the-scheduler
Start-ADSyncSyncCycle -PolicyType Delta
Hi @michev.
But this is a security risk, isn't it? If we disable an account and it's still enabled in AzureAD so the leaver can still access the cloud resources especially when we have synced the password.
Cheers,
Narayan
Not really, disabling the user doesn't stop access immediately anyway. The user will continue to have access for the validity of the access/refresh token. To speed things up, kill the refresh tokens, remove license and block email protocols.
3 people are following this question.