We do not sync our LDAP tree, we just use it to authenticate to.
When a student undergoes a name change in our system their username and email is updated. What I have done in the past is switched their account to manual, changed the username and email address in moodle and saved. Then gone back in and switched it back to LDAP auth.
This method worked in the past but now that we have upgraded to 3.7.1, when I switch it to LDAP auth, the correct username is showing (what I entered in from when I switch it to manual), but when I try to save, it says it's a required field. So it seems since it is locked, it's not seeing the value there or not trying to update it.
So as of right now, I have to way to keep my users using LDAP auth if their username changes.