Your company network includes Forefront Identity Manager (FIM) 2010 and Active Directory Domain Services (AD DS). You create a FIM Management Agent (MA) for AD DS. You receive the following error…

The "Replicate Directory Changes" permission (DS-Replication-Get-Changes) is specifically designed to allow an account to query and read directory changes from Active Directory, which is precisely what the FIM Management Agent needs to perform a successful import from the domain partition. This permission grants the MA account the ability to act like a replication partner for the purpose of reading changes, thus overcoming the "Replication access was denied" error.

The "Replication Synchronization" permission is typically used for initiating replication writes between domain controllers, not for merely reading changes during an import by an identity synchronization engine.

While "Replicate Directory Changes" is the correct permission, applying it only to the Configuration container would not grant access to the primary user, group, and computer objects located in the domain partition, which are the usual targets of a FIM import.

This option combines the incorrect permission ("Replication Synchronization") with the wrong scope ("Configuration container") for an identity management import seeking user data from the domain.