...

Provisioning operations can act on Apache Syncope only or be propagated towards external resources.

The propagation implements the provisioning on external resources. It depends on the assignment, directly or indirectly (via memberships), of users/roles to external resources.

...

A synchronization process can be used to perform a bulk provisioning operation involving either Syncope and one or more external resources.

Propagation

A propagation towards a specific external resource occurs if and only if the external resource's connector instance capabilities permit.

Manage external resource provisioning directly

Provisioning will occur on a certain external resource every time the operation involves Propagation will be tried on an external resource for each provisioning operation involving users or roles assigned to that resource.

Users and roles can be assigned to a certain an external resource by defining a direct or indirect link between objects.

By the way, Apache Syncope empowers the possibility to control the existence of users/roles on external resources giving the possibility to manage remote provisioning directly. 

In fact, an authorized user (or an internal task - a sync task, for instance) can ask for

• link / unlink users/roles to/from specific resources (soft link),
• assign / unassign users/roles to/from specific resources (hard link),
• provision / de-provision users/roles on/from specific resources (maybe, without any link).

Link/Unlink

Apache Syncope gives the possibility to create and remove a sort of soft linking between users/roles and resources.

...