[keycloak-user] User Federation - LDAP - syncronize changed users

Hi We have a user federation setup that connects to Microsoft Active Directory (AD) We are having an issue where when user attributes such as "memberof" or extension attributes are updated, it does not update it in keycloak. We have the synchronize changed users set to activate every half an hour. How does Keycloak identify if the user has changed in AD? Are you using the AD attribute "whenChanged" or is it some other attribute? Appreciate any help. Cheers Travis