I have a scenario, where
- Navigation link has Audience set to several AD groups (Azure AD Connect is used to sync on-premises AD up the cloud).
- A test user is a member of those groups when Audience was configured and he sees navigation links OK.
- I remove this user from all of the groups, leaving just as Domain Member
- Ensure this change is replicated to Azure AD (can see this group "delete" update going through in synchronisation log)
The result is: test user can still see links protected by Audience, even though he is no longer a member of any groups directly or indirectly.
Another point confirming group changes have replicated is access to libraries, which are protected with the same AD groups. The test user loses access to libraries as expected.
Logging user off Sharepoint doesn't change anything. Waited for more than 2 hours and logged off and on again - still can see private links.
Update: Now, after a good 4 hours or so, the test user can't see the links again, meaning everything works as intended. I am quite confident it is a cache issue, but I still don't know where to control it.
Another update: I have been working with SPO support engineer and this issue replicates on their vanilla SPO site without any content, however there is a much shorter delay before new group membership applies to navigation.