Provided everything is set up properly, adding users to the Active Directory should add those users to the Platform and assign the user accounts the Group Permissions from the Active Directory. For current CivicEngage sites, the users added to the Active Directory will be added to the User Administration module in addition to the Platform.
Updating the Group Permissions of users in Active Directory should update the Groups of the user accounts on the Platform.
Removing users from Active Directory does not remove the user accounts from the User Admin module. It will, however, prevent the users from logging into the site via AD. Users will also need to be removed from the User Administration module or Platform.
Removing the Group Permissions from users should keep them from accessing any non-public areas of the website. Platform Groups that have Syncing enabled will be updated for a user when that user attempts to log in.