Why Global Users Become Out of Sync

The following are some reasons why global users become out of sync with their provisioning roles or account templates:

Earlier attempts to create the necessary accounts failed due to hardware or software problems in your network, thereby causing missing accounts.
Provisioning roles and account templates may have changed, thereby creating extra or missing accounts.
Accounts were assigned to account templates after they were created, so accounts exist that have not been synchronized with their account templates.
The creation of a new account is delayed because the account was specified to be created later.
A new endpoint was acquired. During exploration and correlation, the Provisioning Server does not assign provisioning roles to the global users automatically, so you must update the role to indicate which users should have accounts on the new endpoint. Any account that was correlated to a global user is listed as an extra account when the global user is synchronized.
An existing account was assigned to a global user by copying the account to the global user, thereby performing a manual correlation and establishing an extra account.
An account was created for a global user other than by assigning the user to a role. For example, if you copy a global user to an account template that is not in any of the user's provisioning roles, the account is listed as an extra account or as an account with an extra account template. If you copy the global user to an endpoint to create an account using the endpoint's default account template, that account could be an extra account.