Azure user provisioned but doesn't appear in ASM

I have a new deployment of Apple School Manager which should get it's users synced from Azure/Entra AD. The Azure logs show a successful connecting to ASM and the test user was synced but it is not showing up under Users in ASM. On the Apple side, I've federated to AAD and verified my domain, then turned on Directory Sync, but the Directory Sync page says "Your Microsoft Azure AD Sync feed is paused. Federate a domain to resume the Microsoft Azure AD Sync feed." The domain is showing as federated under the Accounts page: "Microsoft Azure Active Directory Configured".