What it means
Directory sync keeps a tool's user list matched to the source directory. It usually runs through the SCIM standard or a vendor API, and it covers creating, updating and deactivating accounts and mapping groups to roles. It differs from single sign-on, which only handles sign-in. A person can sign in through SSO and still need an account that directory sync creates.
Why it matters when you buy software
Directory sync is often limited to higher plan tiers, commonly the enterprise plan, so the price of a tool can change once a team needs it. Buyers should check whether a tool supports it, which directories it connects to, and whether deprovisioning is automatic. Automatic removal of leavers reduces the risk of old accounts keeping access and makes audit evidence easier to produce.
How it works in practice
An administrator connects the directory to the tool and chooses which users and groups to sync. The directory then pushes changes, or the tool polls for them. A new hire appears in the tool with the right role, and a departure disables the account depending on the setup.
See also: MFA, Passkeys and the glossary index.