Hello,
To address this issue, we could leverage the whenChanged attribute, which is a datetime attribute in Active Directory.
The idea would be to define a setting populated by a policy scheduler, populated with the date corresponding to the previous (or scheduled) execution of the synchronization task.
On the application connector side, we would then simply compare the whenChanged value of the objects with the value of the setting, using a filter configured in additionalSearchFilter, to retrieve only the objects created or modified since the last synchronization.
To also include deleted objects, we would need to add (isDeleted=TRUE) to the LDAP filter (`additionalSearchFilter`), because whenChanged alone only detects creations and modifications.
Finally, it's possible to optimize reads by configuring the pagingStrategy property. I'll leave it to you to determine the most suitable paging method for your needs.
Regards,
Hassan