Settings such as UserGroupFilters and AzureAdGroupQueryOptions are stored in configuration files (appsettings.json and userappsettings.json resp.) on each AIM and RSSO server. Given that the user has no direct control over which server gets selected for authentication, which may differ each time they log in, it's essential to keep these files consistent in order to avoid surprises due to configuration differences (e.g. some roles may be filtered out on one server but not on another, preventing users from accessing data they could access before). Currently this task is left to the admin(s), but it would be better if there's some synchronization mechanism to make this automatic.