Directory sync service

Design a directory-sync service that keeps user and group data synchronized from thousands of customers' source-of-truth directories (Active Directory, Workday, Google Workspace) into your platform, where each customer may have hundreds of thousands of users, syncs run continuously, and a person joining/leaving/changing groups in the source must reflect on your side reliably and in order, without a transient sync error leaving access in a wrong state. Walk through the sync model (push vs pull, full vs incremental), how you keep it correct under partial failures, and the consistency model you expose.