Sync Phase Timeline
A breakdown of how long each phase of a sync took, with nested bars for the steps inside a phase. Use it to find the slow part of a long sync without reading server logs.
Requires role: Admin (the Bridges and Identity Providers pages are in the sidebar's Admin section)
Related: Identity Bridge, Bridge Configuration, Risk Posture Dashboard
Overview
Every sync runs through a series of phases: reading the directory, importing objects, building permissions, and analysis. The Phase timing bar shows each phase's share of the sync. The Phase breakdown under it lays the same phases out as a waterfall, and opens the phases that record their own steps. That shows what inside a slow phase took the time.
Both appear under the sync history on a bridge's page, and on Admin > Identity Providers for an Entra ID tenant. They're built from the times each phase records when it finishes, stored with the sync's history row, so they survive server restarts and page reloads.
Prerequisites
- Role: Admin
- Data: A sync in the sync history. Rows from before per-phase timing show only a few coarse phases.
Viewing the Timeline
- Select Bridges in the sidebar. For an Entra ID tenant, open Admin > Identity Providers instead.
- Select the bridge, or choose the tenant from the provider menu.
- In the sync history table, select a sync. The newest one is selected when the page opens.
- Below the table, find Phase timing. Its header gives the sync's total time. For a successful sync, that's the value in the table's Duration column.
- Select Show phase breakdown.
The Phase breakdown opens below the bar. It stays open or closed as you switch between syncs, until your browser session ends.
Each row is a phase, in the order it ran, with its duration on the right. A bar's width is its phase's share of the whole sync. A sync shows only the phases it ran. You may see:
- Directory read, or Microsoft Graph read for an Entra ID tenant
- Import objects
- Remove stale objects
- Criticality rules
- Wait for other domains
- Build permissions
- Entra ID sync
- Recheck remediated accounts
- Criticality
- Effective permissions
- Analytics
- Summaries
- Finish
- Remove deleted objects, on a full sync only
- Between phases: time no phase recorded, such as start-up and wrap-up. It shows only for a successful sync, and only when it's 1 second or more.
Rows from older syncs can also show Fidelity levels.
Expanding Sub-Phases
A phase that records its own steps has a caret (>) before its name.
- To expand a phase, select its row. The caret turns down, and the steps appear as indented bars under it.
- To collapse it, select the row again.
Analytics starts expanded. It covers both junction analysis and the analytics steps, and it usually varies the most, so it's the best place to start.
What each expanded phase shows
Analytics expands into the junction steps, then the analytics steps:
| Step | What it covers |
|---|---|
| Find junctions | Walks the identity graph to find convergence points |
| Junction sources | Breaks down each junction by the access paths that feed it |
| Lateral movement scores | Scores how central each identity is in the graph |
| Save junctions | Saves junction results and updates identity flags |
| Privileged group check | Finds privileged groups before the analytics steps run |
| Over-permission | Compares each identity's permission count with its peer group |
| Stale admin flags | Admin accounts past their staleness thresholds |
| Identity Inventory | Builds the Identity Inventory |
| Delegation Risk | Scores delegation on OUs and containers |
| Platform Health | Computes Platform Health indicators |
| Non-human identity classification | Classifies non-human identities |
| Platform Health summary | Summarizes Platform Health |
| Risk posture | Computes risk factor scores |
| Risk snapshot | Records the daily risk posture snapshot |
| Behavior context | Adds behavior context |
| Behavior baselines | Updates behavior baselines |
Other steps, such as Security Posture, can appear too.
Entra ID sync expands into Owners of app registrations, Owners of service principals, Service principals and Permissions.
Fidelity levels, on older syncs only, expands into Raise fidelity and Lower fidelity.
Reading the Timeline
Bar width and offset
A phase bar's width is its share of the whole sync, and the phase bars run left to right in order.
A step bar is measured against its phase instead. Steps are laid end to end in the order they were recorded. Each bar's width is its share of the larger of two times: the phase's duration, or the steps' total. Analytics steps can run at the same time, so their times can add up to more than the phase. When they do, the step bars fill the row.
A gap after the last step is time inside the phase that no step recorded.
Hover over a bar to see its name and duration.
Duration labels
Each row shows its duration on the right:
- Under 1 second, in milliseconds, such as
420ms. - From 1 to 60 seconds, in seconds with one decimal, such as
4.2s. - Over 60 seconds, in minutes and seconds, such as
12m 34s.
Failed phases and steps
A phase or step that returned an error has a red bar and a Failed label. A failed step doesn't always fail the sync. Some analytics steps don't stop the rest, so the sync carries on. If the sync's row reads Success, a red step failed without stopping the sync.
Troubleshooting a Slow Sync
A full sync takes 45 minutes or more
- Open the bridge's page and select the slow sync.
- Select Show phase breakdown.
- Find the widest phase bar. It's the largest share of the sync.
- If it's Analytics, find the widest step inside it. In large environments, these are often slow:
- Identity Inventory and Delegation Risk are usually the longest steps for domains with hundreds of thousands of identities. Over-permission and Risk posture come next.
- Find junctions can be slow in graphs with many convergence points.
- Lateral movement scores usually takes under 30 seconds. If it's wide, the graph may have an unusually large number of highly central identities.
- If it's Build permissions, the breakdown has no steps for it. Its time depends mostly on the number of access control entries in your directory and the size of the graph.
"There's a Wait for other domains bar before Build permissions"
When one bridge syncs several domains of the same forest, a domain's permissions can name principals from another domain. For example, the forest root's Enterprise Admins can appear in a child domain's permissions. So each domain waits to build its permissions until every other domain in the same pass has imported its objects. That way the cross-domain permissions resolve, whichever domain the bridge read first.
Wait for other domains is that wait. It appears only for bridges with more than one domain, and only on a full sync that waited. On a healthy pass it lasts seconds, the time for the other domains' objects to arrive. A single-domain bridge and every delta sync skip it.
If the wait ends early, the sync's row carries a warning that starts "Permissions from other domains may be missing". It gives the reason and names the domains that finished. GraphnAI built permissions with the domains that had finished, so permissions granted to principals from the other domains are missing until the next full sync. Common causes:
- Another domain couldn't start its sync, for example because its start was rejected or its domain controller was unreachable.
- A new sync pass started for the bridge before the first one finished.
- No domain in the pass reported progress for 15 minutes, the default limit.
- Another domain of the forest has never finished a sync. The warning names it. Sync that domain, then run a full sync of this one.
"The Analytics phase expanded, but there are no step bars"
Steps are recorded when each one finishes. A sync from before per-step timing has none, so no nested bars appear. Select a newer sync.
"A step is red, but the sync reads Success"
Some analytics steps don't stop the rest of the pipeline. When one fails, GraphnAI records the failure for that step and carries on, so the sync can still succeed. To find the error, search the server log around the sync's time for post-sync sub-phase complete lines where failed is true. The subPhase field names the step, such as over_permission or delegation_posture.
"Phase timing doesn't appear"
Possible reasons:
- No sync is selected. Select a row in the sync history table.
- The sync has no recorded timings. A row with no phase times has nothing to draw.
The phases you see also depend on the sync:
- A sync that's still running shows the phases that have finished so far.
- A delta sync that found no changes skips analysis, so it has no Analytics row.
- A delta sync with changes recomputes analytics only for the identities that changed and those that depend on them, so its analytics steps are usually short.
- An older sync shows only a few coarse phases.
What the Data Represents
Each time is elapsed wall-clock time, from when a step started to when it ended. With several domains syncing at once, a phase may wait briefly for resources the domains share. That wait counts in the phase's own bar. It isn't a separate step.
The times are stored in the sync's history row. They stay available for as long as that row is kept, whatever restarts or later syncs happen.