Just as with individual users, the LdapDataCollector job periodically integrates user groups with Kron PAM. See also the LDAP/AD Integration section.