battagfe.
The sync-interval is configurable in User-->User Access Policy-->Service Parameters-->System Settings-->System Parameters @ the bottom of the page
Within the LDAP sync policy you can also configure it to Sync users as needed (for clients authenticating via PAP or EAP-MD5) in that case if they are not in the UAM database it will look for them in LDAP. If you are going to MSAD using PEAP/MS-CHAPv2 it's not possible to do that, in that case if you wanted that behaviour you would set an access policy as the default access policy that was PEAP-MSCHAPv2 - UAM will then check with AD and will synchronize if it finds that user (regardless of the authentication result). So you have some check in real-time options.
Whether or not it synchronizes the password is dependent on how the sync policy is configured, One of the pages in the LDAP sync policy configuration detemines the fields to sync
In the case of AD it's not possible to sync the password, so it is always authenticating password against AD (UAM needs a password in the field, but I believe that password only comes into play if you were to un-bind the user from LDAP for some reason - otherwise the user authenticates with the password stored in AD). For generic LDAP you may sync on a password field, and in that case the password would be synchronized locally in UAM.
Hope it helps,
PL
#uam