The results of the WAAD cmdlet:
Get-MsolUser -Synchronized
do not match what we see from the O365 portal. I believe the issue is that different criteria is used: for the portal, the list of users that are synced is based on the presence of the LastDirSyncTime attribute, while for the WAAD cmdlet, they seem to be based on the presence of ImmutableID.
A easy way to reproduce this is to create a disconnector by deleting an AD object. This will place the corresponding WAAD object in the soft-deleted container as a disconnector (with null value for LastDirSyncTime, while perserving the ImmutableID) and there will be a mismatch between the information the provided in the portal vs the WAAD cmdlet. I.e. there will be non-zero objects matching the following:
Get-MsolUser -all -ReturnDeletedUsers| ? {$_.LastDirSyncTime -eq $null -and $_.ImmutableID -ne $null}Alternatively, the issue might be with the sync process incorrectly disconnecting the object from the metaverse.