In a custom provisioner Dao, nothing calls an explicit disconnect method to make external logout calls. I was able to implement a custom Runnable inner class in my Dao . The close method gets invoked when the Dao goes out of scope and gets cleaned up, but it only works for a full sync (maybe because it's in a thread?). For incrementals, this doesn't get called for some reason.

The EsbConsumer class has a disconnect() method, which can be called at the end of a run. But nothing implements it, including the ProvisioningConsumer.

Ideally both the incremental and full should explicitly call a disconnect method, so that the API calls get logged along with the job run. A TargetDao can then implement whatever might be needed.