Entra Connect Directory Synchronization timing

Question

Our SSPR process has been taking upwards of 7 minutes to update password via the Entra Connect password writeback feature and users were unable to log into their Intune cloud only machines until the password writeback was finished. We identified that we were running an outdated version of Entra Connect and updated to the lastest via a Swing Migration.

Once this migration was completed we appear to still be seeing delays for longer then a minute at times and other times it can be instant for the end user.

Below example:
User initiated SSPR at 5:07:11 PM , on premises domain controller received and updated the password by 5:07:20 PM CST. The user was unable to have a successful log in with Entra until 5:09:05 PM CST for a total login failure delay of 114 seconds.

When looking at the Entra Connect logs and the on premises domain controller the password change was seemingly instant but the Directory Synchronization events didn't report back till the 114 second mark. Is this an event delay from on prem to the Entra Connect server we would need to look into?

Answer 1

It can take 2 minutes or so:

https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr#faqs