Microsoft Graph Won't Tell You Your Directory Sync Is Broken

PAM-Pro discovers every managed account through Microsoft Graph. That's a deliberate choice - it means no agent on your domain controllers, no VPN tunnel back to on-prem infrastructure, nothing running inside your network perimeter at all. For a cloud-native product, it's the correct architecture. It's also the reason I had to build a feature whose entire job is telling customers something Graph itself will never tell them: that their directory sync is broken.

Graph Answers the Question You Asked, Not the One You Meant

Here's the failure mode that got me here. A customer runs a hybrid environment - on-premises Active Directory synced to Entra ID via Entra Connect. PAM-Pro's discovery worker is registered, online, checking in on schedule. Everything in the PAM-Pro dashboard looks healthy. And an entire OU of privileged accounts is invisible, because sync to that OU quietly stopped weeks ago and nobody noticed.

Query Microsoft Graph for directory objects and it gives you an honest, complete answer about what's currently in Entra ID. It has no way to tell you what's supposed to be there but isn't, because from Graph's perspective, an account that never synced doesn't exist - there's no error, no gap flagged, nothing to detect. "The worker is online and Graph calls are succeeding" and "your directory data is complete" are two different claims, and a health check that only verifies the first one will report green while an admin's actual attack surface is silently undercounted.

Building a Check for a Problem the API Won't Surface

The fix wasn't more Graph calls - it was a different kind of check entirely. The Directory Connectivity panel in Settings actively confirms Entra Connect is really syncing on-prem accounts, instead of inferring it from worker uptime. Where Graph exposes it, the panel also reads whether Password Hash Sync and Password Writeback are actually enabled for the synced directory - a live read that supplements the customer's own self-attestation rather than replacing it, because I'd rather show "here's what we can verify, and here's what you told us" than silently trust a checkbox that could be stale.

The follow-up release went a layer deeper: a Domain Inventory that groups every discovered AD domain, names which Entra tenants it appears in, and shows which verified UPN suffixes were actually seen on it. Multi-domain hybrid environments are common enough that "which domain did this account actually come from" isn't a rhetorical question - it changes which on-prem systems a password reset needs to reach, and getting it wrong is exactly the kind of quiet mistake that only surfaces during an incident.

Why This Matters Beyond PAM

I think this generalizes past privileged access management. Almost every tool that integrates with Entra ID via Graph inherits the same blind spot: Graph is a faithful mirror of cloud directory state, and a faithful mirror of an incomplete sync is itself incomplete, with no signal saying so. If your security tooling's health check is "can I call the API successfully," that's necessary but nowhere near sufficient for a hybrid environment. The API succeeding and your directory being fully represented are independent facts, and conflating them is how gaps stay invisible until an audit or an incident finds them for you.

I'd rather ship the uncomfortable "sync off" badge than the comfortable dashboard that's wrong. It's a smaller feature than it sounds like, and it was worth building specifically because Microsoft's own API surface will never build it for you - Graph tells you what it knows, and it doesn't know what it never received. Both releases are in the full release notes, if you want the version-by-version detail.