The fan-out process works as follows:
A user in the Identity Vault is granted a User Account entitlement.
Based on the entitlement parameter value, the policies create the destination DN that places a new account in the corresponding SAP client.
The driver adds an association to the user in the Identity Vault.
All changes to the object in the Identity Vault are fanned out based on the specific association.