Currently it seems that when we add and/or modify groups in Active Directory in a Windows domain, we then have to log into Vault and manually update the groups to pick up changes. This is fine if we explicitly know that folks are being added to the groups, but we DON'T know when folks leave the group (fired, change roles or jobs, etc.). At a minimum, we should expect Vault to auto synchronize with the AD group on some schedule to pick up changes so that we can remove this burden from our administrator(s). It becomes a real issue when we have groups with tens or even hundreds of users in the group.
