Why Users Become Out of Sync

The following are some reasons why users become out of sync with their provisioning roles or account templates:

Earlier attempts to create the necessary accounts failed due to hardware or software problems in your network, thereby causing missing accounts.
Provisioning roles and account templates may have changed, thereby creating extra or missing accounts.
Accounts were assigned to account templates after they were created, so accounts exist that have not been synchronized with their account templates.
The creation of a new account is delayed because the account was specified to be created later.
A new endpoint was acquired. During exploration and correlation, the Provisioning Server does not assign provisioning roles to the users automatically, so you must update the role to indicate which users should have accounts on the new endpoint. Any account that was correlated to a user is listed as an extra account when the user is synchronized.
An existing account was assigned to a user by copying the account to the user, thereby performing a manual correlation and establishing an extra account.
An account was created for a user other than by assigning the user to a role. For example, if you copy a user to an account template that is not in any of the user's provisioning roles, the account is listed as an extra account or as an account with an extra account template. If you copy the user to an endpoint to create an account using the endpoint's default account template, that account could be an extra account.