Apple Business Manager - All users syncing from Microsoft Entra instead of pre-configured ones

I previously implemented integration with AAD when it first became available and it limited which accounts synced by those present in the "Users and groups" section of the relevant "Enterprise App".

I'm setting this up at a new organisation and things have evolved; not necessarily in the best direction. It's syncing every single user in our directory. It's completely ignoring the "Users and Groups" config for the Entra App.

Is this normal? Is this what others see when you connect to Entra for account syncing now?

I wanted it to sync 4 accounts today and instead it's done 7,199.

I've called Apple Business Support but they didn't immediately recognize this issue and said they'd need to get back to me tomorrow.