Just an update on this.
After a lot of debugging, signal tapping and head scratching it has been discovered that there is a password reset script run from an external system (bladelogic) which for some unknown reason decides to run "authconfig --update" after doing whatever it does. This stops the SSSD service and doesn't automatically restart it - is this normal behaviour?
A big thank you to Justin and Jakub for your help