On this page0
Guide
Fix directory drift with AlignSync
Find the people whose details disagree between Zonitix and your connected directories, preview the corrections, apply them, and undo one if it was wrong.
Before you start
- This guide assumes you know your company’s directories well enough to say which one holds the correct value for a person; if you do not look after them, do this together with the person who does.
- At least one directory connected and verified under Access GovernanceIdentity Hooks. See Connect Okta, Entra or Google.
- A role that lets you work with AlignSync. Without one, Access GovernanceAlignSync is not in your menu. Viewing, changing the policy, applying changes and approving them are separate rights, so you may be able to look but not apply. In the built-in set, administrators hold all of them, and so does the “integration_manager” role, which no group carries, so an administrator gives it to a person by hand.
- To correct a directory (not just Zonitix), its hook needs “Write Users” switched on. Attribute corrections can be written to Microsoft Entra ID, Okta and Active Directory or OpenLDAP. Other directories can be read and compared but not written to.
See what is out of step
Step 1: Open AlignSync
Go to Access GovernanceAlignSync. The page has three tabs: “Drift”, “Directory” and “Logs”.
On the “Drift” tab, four tiles sum things up: “In sync”, “In drift”, “Sources” and “Waiting for approval”. “By attribute” shows which details disagree most often.
Step 2: Scan again if you need fresh numbers
Click “Re-scan”. A scan checks every person against every connected directory, so Zonitix keeps the last result for a few minutes rather than repeating it on every visit.
Decide which source wins
Step 3: Open the policy
Click “Policy”. The “Alignment policy” window opens.
Under “Attribute authority”, each detail (such as department or job title) has an “Enabled” switch and a “Source of truth”. Switch off any detail you do not want AlignSync to touch, and pick the source that should win for the rest.
Step 4: Optional: use an HR export as the source
Under “Source of truth file”, click “Upload CSV” and choose your HR export. The file needs an email column. Uploading, replacing or removing the file takes effect straight away; it does not wait for “Save policy”.
Step 5: Set the safety limits
“Blast radius cap (%)” is the largest share of your directory one bulk change may touch. Anything bigger is stopped and you are asked to confirm.
“Require approval for large reconciles” makes a second person approve any bulk change that touches at least “Approval threshold (users)” people. It is off until you switch it on. We recommend switching it on.
“Auto-reconcile” runs a scan on a timer. Set “Interval (hours)” and “Drift threshold (%)”, and leave the mode on “Preview only” unless you want corrections written without anyone looking first, which is what “Auto-apply” does. “Write targets” chooses which directories it may write to.
Click “Save policy”.
Fix one person
Step 6: Open their record
On the “Directory” tab, find the person with “Search directory user...” and click them. Their record has four tabs: “Attributes” (each detail side by side across sources), “Drift”, “Groups” and “History”.
Step 7: Preview, then apply
Click “Reconcile”. It walks you through three steps: “Source of truth” (which source wins), “Where to sync” (which places get corrected) and “Review & apply”.
Leave “Simulation (dry run)” switched on and click “Preview alignment”. Read “What will change”. When it is right, switch the simulation off and click “Apply for real”.
Fix many people at once
Step 8: Select them
On the “Drift” tab, tick the people to fix, or click “Select all drift”. As soon as someone is selected, a panel opens beside the list with the same three steps.
Step 9: Preview all, then apply
Leave “Simulation (dry run)” on and click “Preview all”. Check the list, then click “Apply for real”.
If the change is larger than your blast radius cap, it stops with “Blast-radius cap exceeded”. Click “Override and re-run” only if the size is what you intended.
If approval is switched on and the change reaches the threshold, it is not applied. It waits for an approver, who clicks the “Waiting for approval” tile on the “Drift” tab (or “Approvals” on the “Directory” tab), opens the request and clicks “Approve” or “Reject”, then “Confirm approval” or “Confirm rejection”. The approver cannot be the person who asked for the change.
Tidy up and undo
Step 10: Find accounts that should not exist
Click “Directory hygiene”. For each connected directory it lists “Orphans in IdP” (an account there with no matching person in Zonitix), “Missing from IdP” (a person in Zonitix with no account there) and “Status mismatch” (active in one place, disabled in the other). “IdP” is short for identity provider, meaning the connected directory. Click “Rescan” to refresh it.
Step 11: Undo a change
Open the “Logs” tab. “AlignSync action audit trail” lists every change with when, who it affected, the source used and who ran it. Click “Rollback” on a row to put the earlier values back, in Zonitix and in the directory. “Export CSV” downloads the list.
What you should see
After you apply a change, the person shows “In sync”, the “In drift” tile goes down, and a new row marked “Applied” appears on the “Logs” tab.
A row you rolled back is marked “Rolled back”.
If something goes wrong
- A notice says "One connected directory is read-only".
- That directory can be compared but not corrected. The notice says why and what to do about it. Click IDENTITY HOOKS to go to the hook.
- Auto-apply cannot be selected, or the policy says "Auto-apply is unavailable."
- None of the selected write targets can be written to. Pick a write target whose hook has Write Users switched on, or keep the mode on Preview only.
- A row on the Logs tab says "Partial" or "Partial rollback".
- The change reached some places but not all. Check the hook for the directory that was missed under Identity Hooks, then run the reconcile again. A partial rollback can be retried with Rollback on the same row.
- "You cannot approve your own change request — a different person must approve it."
- Ask another person who is allowed to approve identity changes to click the Waiting for approval tile on the Drift tab (or Approvals on the Directory tab) and decide it.
- Scheduled auto-reconcile never seems to run, or no drift alert email arrives.
- Check that Auto-reconcile is switched on in the policy and that enough hours have passed for the interval. The alert email needs email set up under Security Settings, and goes to your primary administrator.
Still stuck? See When something goes wrong, or Contact Zonitix support.