Configuration Processing Workflow

I am trying to get a handle on what the workflow is on the following scenario on Desktop Central.

Configuration created in Desktop Central (software installs) where the target is an AD Security Group. Members of this group are computer objects
A new machine is deployed using MDT to install the OS and Desktop Central Agent. Computer object is placed in a Staging OU in AD during deployment.
Machine Object in AD is added to security groups in AD used to manage software install targets in Desktop Central.

The question I have is what is the workflow for the last step. What needs to occur for the Desktop Central Configuration to acquire the new targets from the Security Group. Does Desktop Central need to sync with AD to pickup the new targets or does the agent on the client push it’s group memberships to the Desktop Central server?

Preferably what I am looking for is, a means to force a “sync” after the machine objects have been moved to the respective security groups in AD in order to have the configurations (software installs) applied on demand.