it appears “pwdLastSet” isn’t allowed in attribute sync. Its in my create/update policies, but does not appear in attribute sync config. If someone can confirm that, that would be cool. If that’s the case, I’ll fall back to using a rule. This was still a worthwhile exercise to understand we can create an “update” provisioning policy that is different than a “create”.