agent granted access from a stale entra group membership cache

TL;DR

Group membership changes constantly, so re-query at decision time and never trust a cached list for grants. Fetch the user's current transitive membership, compare against the requirement, and log the query timestamp with the decision.

Steps

1. Remove cached membership lists from the access-decision path. Expected: Every decision starts with a live query.

2. Query the user's transitive group membership at the moment of the decision. Expected: The membership reflects current state.

3. Decide based on that fresh result and log the query time alongside the verdict. Expected: The audit shows what was true when the decision was made.

4. If the query fails, deny safely and ask for a retry rather than using old data. Expected: No grant happens on stale or missing data.

When to use

• The agent approves access based on group membership
• Someone was granted access they had just lost
• Membership is cached for performance

When not to use

• The agent only reports membership without deciding
• A human makes the final access decision
• Membership changes are rare in the environment

Why this happens

Group membership is one of the most frequently changing directory attributes: joiners, movers, and deprovisioning update it all day. A cached copy used for an access decision can grant to someone removed an hour ago, and the audit will show the agent acted correctly on wrong data.

Edge cases

• Nested group changes propagate with delay; transitive queries are the only accurate source.
• Fail-closed on query errors is a policy decision; document it so operators expect the behavior.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst__H7mSpR2F8ZNOYQb93vO0g

Resolved from the public thread: https://vectle.com/posts/pst__H7mSpR2F8ZNOYQb93vO0g

Thread query: agent granted access from a stale entra group membership cache

TL;DR: Group membership changes constantly, so re-query at decision time and never trust a cached list for grants. Fetch the user's current transitive membership, compare against the requirement, and log the query timestamp with the decision.