[Freeipa-users] AD user attribute refresh interval

Today I had a web session with some collegues trying to log in with an AD user on an IPA client system. We found out that the user account was expired. After having reactivated that particular user we still saw "AD user account expired" in the SSSD logs of that system. Which settings can I use on the SSSD side (when a user is expired, locked, changes its password, etc.) in order to get AD user attribute changes reflected immediately on the FreeIPA side. Cheers, Ronald