Delta Membership Collection
Group membership changes made outside GraphnAI, in Active Directory Users and Computers, in PowerShell or by another admin, show in the identity graph after the next delta sync. You don't wait for the next full sync.
Requires role: Operator (view collection status and details, start a full sync), Admin (Run full sync from a membership warning)
Related: Identity Bridge, Bridge Configuration, Domain Auto-Discovery
Overview
A delta sync reads only the directory objects that changed since the last sync, which keeps it fast. Group membership used to slip through that gap.
A membership shows on both sides in Active Directory: in the group's member list and in the member account's memberOf list. GraphnAI builds memberships from each account's memberOf. Adding someone to a group changes the group's change marker (USN), but not the member's. A delta sync that read only changed objects saw the group change, but never re-read the accounts whose memberships changed. The change stayed hidden until the next full sync, once a day by default.
A new member of Domain Admins, added on purpose, by mistake or by an attacker, could stay out of the graph for up to a day. So could every risk score, exposure and blast radius that depends on who is in that group.
Delta membership collection closes that gap. When a delta sync sees that a group's membership changed, the bridge asks the directory for the group's current members and adds them to the same sync. The graph, criticality tiers and exposure update at once. The bridge reads large groups in ranges, so a big group isn't cut short. A group above the per-group limit (5,000 members by default) is skipped for that sync and named.
It works for every domain an Identity Bridge syncs, with nothing to turn on. When a group's membership can't be fully collected, GraphnAI names the group and schedules a repair.
Prerequisites
- An Identity Bridge that syncs an on-premises Active Directory domain. See Identity Bridge.
- Operator role or higher to open the bridge's page and read the collection status.
- Admin role to use Run full sync in a membership warning. Operators can start the same sync with Full sync.
- Nothing to set up. The limits in Configuration Options matter only for very large domains or heavy membership churn.
How It Works
On each delta sync, for each group whose membership changed, the bridge:
- Asks the domain controller for every account that lists the group in its
memberOf, and adds those accounts to the sync. - For a group that could have members from another domain, also asks a global catalog for those members.
- Checks both answers against the group's own member list. Any member it couldn't match is named in the sync's details.
The collection only adds memberships. It never removes one. Some directory searches can return a clean-looking but incomplete answer: a search of another domain that returns no results, or a member with no memberOf link back to its group. A removal based on such an answer could delete a real membership in one of your most sensitive groups. So a delta sync reports a missing membership as an apparent removal, and only a full sync removes it. A full sync reads the whole directory and has its own safeguards for removing access.
Read the Collection Status
Two places on the bridge's page show membership collection status. Both come from the syncs the bridge already runs.
The Domain Table's Memberships Column
Each domain's row shows its membership collection status, from the most recent sync that had something to say about memberships:
| Value | Meaning |
|---|---|
| Complete (green) | The domain's group memberships are fully collected. |
| Membership incomplete (amber) | This domain's own collection couldn't fully collect one or more groups. The next full sync collects them. |
| Repair scheduled (amber) | A group in another domain has members from this domain. The next full sync of this domain records them. Nothing is wrong with this domain's own collection. |
| — | No sync has reported on group membership for this domain yet. |
Only a domain whose memberships a sync has checked reads Complete.
A delta sync in which no group changed says nothing about memberships, so it doesn't change this column. The column keeps the answer of the last sync that did report.
The Sync History's Membership Column
Each row in Sync history shows what that sync found:
| Value | Meaning |
|---|---|
| 12 groups changed | 12 groups changed and all of them were fully collected. |
| 3 groups incomplete (amber badge) | 3 groups couldn't be fully collected. Hover to see up to three names and a count of the rest. |
| — | This sync has nothing to report about memberships. |
The dash covers two normal cases: a full sync, which collects every membership while it reads the whole directory, and a delta sync in which no group changed. For a domain's overall status, read the Memberships column in the domain table.
When Membership Collection Is Incomplete
When a delta sync can't fully collect a group's membership, for example because the group is very large or a directory search failed, GraphnAI:
- Names the groups, instead of reporting a general failure.
- Marks the sync Partial, with a message that says what's missing.
- Schedules a full sync to repair the gap. See Automatic Repair.
- Shows a warning on the bridge's page, in the Platform Health section of the dashboard, and in the sync's details.
Automatic Repair
You don't need to start anything. When a domain is flagged, its next scheduled sync runs as a full sync. That sync collects every membership and clears the flag.
The flag stays visible until the repair finishes: in the Memberships column, in Sync history and on the dashboard. A delta sync that changes nothing in between doesn't clear it. If the warning cleared after a quiet delta sync, it would look fixed while the gap was still open.
Repair backs off, so it can't overload your domain controllers. If the same domain keeps getting flagged, for example by a group whose membership changes every hour, repairs slow down. After the first repair, the next can run after 1 hour, then 2 hours, then 4, doubling each time up to the full sync interval (24 hours by default). The wait resets only after the domain goes one full sync interval without being flagged. One successful repair doesn't reset it, because a condition that comes back on the next delta sync is exactly what the backoff exists for.
Run a Repair Now
To repair a domain without waiting:
- Open the bridge's page.
- Find the warning above the domain table. One appears for each flagged domain, with the domain's name and what happened.
- Select Run full sync.
Run full sync starts the same full sync as the Full sync button, for every domain on the bridge. There's no separate repair action. Only Admins can select it in the warning. Operators see the warning and can use Full sync instead.
The warning reads differently for each cause:
- This domain's own collection: A Membership incomplete badge and "N groups are missing members since [date and time]. The next full sync collects them."
- Another domain found members here: A Full sync scheduled badge and "A group in [other domain] has N members from [this domain]. The next full sync of [this domain] records them." See Cross-Domain Memberships.
Review a Sync's Membership Details
Select a row in Sync history to show its details below the table. A sync that reported on memberships adds up to four sections. Only sections with something to report appear.
Groups not fully collected lists each group by name, with the reason:
| Reason shown | What it means | What changes it |
|---|---|---|
| more members than the per-sync limit allows | The group has more members than the per-group limit. | Raise the per-group member limit. |
| the member budget for this sync was already used up | Earlier groups in the sync used the member budget. | Raise the total member limit. |
| the directory query budget for this sync was already used up | Earlier groups used the search budget. | Raise the directory query limit. |
| the directory returned an error. The next sync retries | A directory search failed. | Check the bridge's log for the LDAP error. |
| no global catalog is available for this domain | Members from other domains couldn't be checked. | Add a global catalog to the domain's controller list. |
| membership collection is turned off for this domain | The total member limit is 0. | Raise it above 0. |
Where known, the row also shows how many members the bridge saw before it skipped the group. The three limits are described in Configuration Options.
Members in other domains lists each member that lives in another domain, and what happens next. When a bridge syncs that domain, its next full sync records the membership. When no bridge syncs it, the row says to add that domain to a bridge. If the domain has no global catalog in its controller list, the section says instead that members in other domains weren't checked.
Members not resolvable lists members the group names that the bridge couldn't trace back through the member's own memberOf. It comes from how some directory objects are stored, most often foreign security principal placeholders, and needs no fix. The section is for information.
Apparent removals says how many memberships look removed. See Apparent Removals.
Apparent Removals
When someone recorded as a group member no longer shows in what a delta sync collected, GraphnAI records an apparent removal. Nothing is deleted then. The membership stays in the graph, and the sync's details say "N memberships look removed in the directory. The graph keeps them until the next full sync confirms it."
The delay is deliberate. The directory searches this feature uses can return a clean-looking but incomplete answer. For example, a search of the wrong global catalog for a group in another domain returns no results and no error. Deleting a membership on an answer like that could strip a real permission from one of your most sensitive groups. A full sync reads the whole directory, and it's the only sync that removes a membership.
A domain with apparent removals is flagged for automatic repair, like an incomplete collection.
Cross-Domain Memberships
A group in one domain can have members from another. For example, Enterprise Admins in the forest root can hold an account from a child domain. When a delta sync of one domain finds such a member, it doesn't record the membership itself. GraphnAI records a membership only through the sync of the member's own domain, so the result is the same whichever domain saw the change first.
GraphnAI flags the member's home domain for automatic repair instead, and that domain's next full sync records the membership. A domain showing Repair scheduled with no problems of its own is almost always this case.
If no bridge syncs the member's home domain, for example a domain outside your organization or one without a bridge yet, GraphnAI says the membership can't be recorded and names the domain to add.
Configuration Options
Delta membership collection needs no settings. For very large domains or heavy membership churn, you can tune three limits. They're environment settings on the bridge host, in its Docker Compose file or system environment. They don't go on the GraphnAI server. An unset or unreadable value uses the default. A value outside the range is moved to the nearest limit, with a warning in the bridge's log. Ask GraphnAI support for the exact setting names.
| Limit | Default | Range | What it limits |
|---|---|---|---|
| Per-group member limit | 5000 | 100 to 1,000,000 | The most members the bridge collects from one group in one sync. A larger group is skipped for that sync and named. |
| Total member limit | 25000 | 0 to 500,000 | The most member accounts the bridge collects across all changed groups in one sync. |
| Directory query limit | 2000 | 1 to 100,000 | The most directory queries the collection makes in one sync. A large group needs several queries, so this budget runs out faster than the group count suggests. |
When to raise them: When Sync history or the dashboard keeps naming groups skipped for a limit, and those groups are meant to have that many members, raise the matching limit.
When to lower the total member limit: When membership collection adds noticeable load on your domain controllers during heavy churn, a lower value caps how much one sync collects. More groups are then named as skipped and repaired by the next full sync.
IMPORTANT
Setting the total member limit to 0 turns off the collection. The reporting stays on: every group whose membership changed is still named, the domain still shows Membership incomplete, and a repair is still scheduled. Turning off the collection can't hide the gap.
A separate server-side threshold (5000 members by default) queues a delta sync's processing behind other heavy work when the sync collects at least that many members. It rarely needs changing.
Troubleshooting
A Domain Shows "Membership incomplete" Every Day
The same groups are too large or change too often to collect within a delta sync's limits. Select one of the affected syncs in Sync history and read the reason under Groups not fully collected:
- More members than the per-sync limit allows: If the group is meant to have that many members, raise the per-group member limit on the bridge host.
- The member budget or the query budget was used up: If your delta syncs often touch many changed groups, raise the total member limit or the directory query limit.
- The directory returned an error: Read the bridge's log for the LDAP error. It points to a connection or permission problem with the directory.
Automatic repair runs on its schedule whatever the cause. Raising a limit only makes the problem come back less often.
A Domain Shows "Repair scheduled" and Nothing Looks Wrong
This is the normal cross-domain case: another domain's sync found a member who lives in this domain. To see which member and which group, open the details of the other domain's sync and read Members in other domains. Nothing more is needed. The scheduled full sync records the membership, or you can start it sooner.
The Membership Column Shows a Dash on Every Recent Row
This is normal when no group membership changed recently, or when the recent rows are full syncs, which don't fill in this column. See Read the Collection Status. Read the Memberships column in the domain table instead. It reflects the most recent sync that reported on memberships.
A Large Group Shows No Members, or Is Missing from the Graph
Check whether the group is a primary group, most often Domain Users. Active Directory records primary group membership differently from explicit membership, and GraphnAI collects it another way (see Identity Bridge). The group names this feature reports don't cover primary group membership. Don't read it as a collection failure.
Warnings Continue After Setting the Total Member Limit to 0
This is expected. A value of 0 turns off the collection, but GraphnAI still names every group whose membership changed as skipped, with the reason "membership collection is turned off for this domain." With collection off, memberships changed outside GraphnAI show only after your regular full sync, which is the delay this feature removes.