Enterprise Manager SSO

Hi We have deployed Enterprise Manager to manage our F5 devices and also assist with SSO to the devices. This way alleviating the need for users to enter there details more than once.

We are using AD to authenticate the user's and they are placed into AD Groups as per the permissions they require. What i have noticed is happening is that if i remove a user from one AD Group and add them to another AD Group, the permissions dont update as required.

Is there a step that I am missing that will enforce the update details to the devices that are being managed, as the EM is getting the update permissions but not the individual devices.

Thank you Sulaiman