Applies to: Centrify for SaaS & Provisioning
When users are moved between OUs in batches, some of the users are removed from the provisioning roles and subsequently may have their licenses revoked.
The reason this occurs is because when changes to users are done, role memberships and attribute changes as well, are not propagated instantaneously.
The Cloud connector's AD watcher usually takes a few minutes before it propagates those changes to the cloud service. The cloud then takes a few minutes before processing occurs, depending on the current cloud load. If provisioning is started immediately thereafter, old data will be seen.
This can be resolved by either waiting for the next sync to take place within 24 hours, or manually forcing a sync under:
- Cloud Manager > Settings > Provisioning > Start Sync.