While the periodic auth sync is good to create new users, it would be very convenient to have it remove user licenses as well, possibly as an option. When a user leaves, disabling their AD account is sufficient for most items, but we need to manually enter DP admin to remove them from there.
Since there are only 2 options for removing users, it could be a simple checkbox to enable "automatically remove users that no longer match filter" and then a radio button to choose "convert to user" or "mark as deleted" as required.