Users that exist only on slave cannot login
Bakery doesn't pre-sync accounts, so any accounts that exist only on slave sites (sub-sites) won't be synchronized to the master site. This is because of the nature of needing an authoritative account master, the Bakery master site. During authentication (on a slave site) Bakery sends the user to the master to validate so if the account does not exist there the user cannot be authenticated.

To note, accounts that exist on the master that do not exist on the slave will be synchronized when the user authenticates and visits the slave site (administrators also have the option to "pull" accounts from the master).