title: Azure Active Directory - user's group claims are not up-to-date
body: <p>I have a <code>.NET Core</code> webapp that uses <code>Azure Active Directory</code> to authenticate users. I have configured the app access in Azure AD and then I put this in my <code>Startup</code> class:</p>
  <pre><code>//Use Azure Active Directory OAuth 2.0 authentication
  services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
          .AddAzureAD(options =&gt; Configuration.Bind(&quot;AzureAd&quot;, options)); //AzureAD settings are stored in appsettings.json
  </code></pre>
  <p>This work correctly and users can successfully authenticate with their Azure AD company account.</p>
  <p>However, inside one of my controllers I need to check which <code>security groups</code> the user is a member of, to perform some security checks. So I use this code to check if the user is part of a certain security group:</p>
  <pre><code>var groupClaims = User.HasClaim(claim =&gt; claim.Type == &quot;group&quot; &amp;&amp; claim.Value == mySecurityGroupUid);
  </code></pre>
  <p>This works... kind of.<br />
  The problem is that <strong>the collection of <code>Claim</code>s inside the <code>User</code> object is only updated when the user logs out of the web app and logs back in</strong>. If the user does not explicitly log out of the webapp and log back in, the list of claims does not update.</p>
  <p>This is a big problem, because it means that if, for example, I remove a user from a security group, that change will not be reflected in my webapp until the user logs out. This means that the user might be able to access data that he is not authorized to access anymore, because the webapp still thinks he belongs to the old set of groups.</p>
  <p>Even stopping and re-deploying the web application does not update the groups, the only way I found to force the groups to update is to have the user explicitly logout of the webapp and log back in.</p>
  <p>So my questions are:</p>
  <ul>
  <li>Is this the intended behavior? Or am I doing something wrong?</li>
  <li>Is there a way to force the list of claims to &quot;sync&quot; with Azure AD?</li>
  <li>If not, is there a way I can forcibly log out all users when my webapp stops and restarts, so I know all users are forced to log back in, which in turn will update their claims?</li>
  </ul>