I found an issue where my users were not being automatically synced by Azure. Apparently this is by design that the sync log does not show the incremental syncs. I realised that I had no new students syncing into their groups and existing groups had not been updated via the sync. A manual sync was performed 3 months prior and then no further logs. This might mean that my incremental was broken, but having the audit log show this would have been an incredibly useful troubleshooting step. This was a near miss, luckily I do have a very restrictive default policy but if I didn't there may have been some trouble!