Nick, thank you for your post. I have carefully compared your screenshots with my settings. "Users" checkbox was ticked in "Sync by domain" part. I have corrected it. I have enforced sync for all enabled Applications, still no luck... unwanted users are still listed in O365 Portal. I am going to give it some time and check if it automatically removes those unwanted users.
If it does not work I would like to let Centrify "take over" and then deprovision unwanted accounts. Where should I satrt?
Thank you, I hope to get advice from you again.