diff --git a/xos/synchronizers/vpn/steps/sync_tenantprivilege.py b/xos/synchronizers/vpn/steps/sync_tenantprivilege.py
new file mode 100644
index 0000000..2595eff
--- /dev/null
+++ b/xos/synchronizers/vpn/steps/sync_tenantprivilege.py
@@ -0,0 +1,52 @@
+import os
+import sys
+
+from django.db.models import F, Q
+from services.vpn.models import VPN_KIND, VPNService, VPNTenant
+from synchronizers.base.syncstep import SyncStep
+
+parentdir = os.path.join(os.path.dirname(__file__), "..")
+sys.path.insert(0, parentdir)
+
+
+class SyncTenantPrivilege(SyncStep):
+    """Class for syncing a TenantPrivilege."""
+    provides = [TenantPrivilege]
+    observes = TenantPrivilege
+    requested_interval = 0
+
+    def fetch_pending(self, deleted):
+        privs = super(SyncTenantPrivilege, self).fetch_pending(deleted)
+        # Get only the TenantPrivileges that relate to VPNTenants
+        privs = [priv for priv in privs if priv.tenant.kind == VPN_KIND]
+        return privs
+
+    def sync_record(self, record):
+        certificate = self.get_certificate_name(record)
+        tenant = VPNTenant.get_tenant_objects().filter(pk=record.tenant.id)[0]
+        # Only add a certificate if ones does not yet exist
+        if (not os.path.isfile(tenant.pki_dir + "/issued/" + certificate + ".crt")):
+            VPNService.execute_easyrsa_command(
+                tenant.pki_dir, "build-client-full " + certificate + " nopass")
+            tenant.save()
+        record.save()
+
+    def delete_record(self, record):
+        certificate = self.get_certificate_name(record)
+        tenant = VPNTenant.get_tenant_objects().filter(pk=record.tenant.id)[0]
+        # If the client has already been reovked don't do it again
+        if (os.path.isfile(tenant.pki_dir + "/issued/" + certificate + ".crt")):
+            VPNService.execute_easyrsa_command(tenant.pki_dir, "revoke " + certificate)
+            # Revoking a client cert does not delete any of the files
+            # to make sure that we can add this user again we need to
+            # delete all of the files created by easyrsa
+            os.remove(tenant.pki_dir + "/issued/" + certificate + ".crt")
+            os.remove(tenant.pki_dir + "/private/" + certificate + ".key")
+            os.remove(tenant.pki_dir + "/reqs/" + certificate + ".req")
+            tenant.save()
+
+        record.delete()
+
+    def get_certificate_name(self, tenant_privilege):
+        return (str(tenant_privilege.user.email) +
+                "-" + str(tenant_privilege.tenant.id))