If the user is originating in the portal, you need to Delta Import -> sync. At this point, it should queue up in the connector space of your ADMA for export. On your ADMA, export, Delta Import, sync. This will queue up the ObjectSID
to go out to the portal user. Export on your Portal MA. This is required for users to log into the portal.
If you need help with setting up user provisioning, check this out. https://blogs.msdn.microsoft.com/connector_space/2017/09/20/sync-rule-walk-through-outbound-system-scoping-filter-user-synchronization-rule/
Mike Leach | http://blogs.catapultsystems.com/mleach/default.aspx