Configure the sync pipe to filter changes by access control instructions

Set the filter-changes-by-user property to filter changes based on access controls for a specific user.

$ bin/dsconfig set-sync-pipe-prop \
  --pipe-name "Notifications Sync Pipe" \
  --set "filter-changes-by-user:uid=admin,dc=example,dc=com"

On the source directory server, set the report-excluded-changelog-attributes property to include the names of users that have been removed through access control filtering. This will allow PingDataSync to warn about attributes that were supposed to be synchronized but were filtered out. This step is recommended but not required.

$ bin/dsconfig set-backend-prop \
  --backend-name "changelog" \
  --set "report-excluded-changelog-attributes:attribute-names"