Access Tokens over VPN? How to grant new GROUPS to remote users?

Normally, after adding a user to a new AD Group, I have the user logoff/logon and they then have access to the share.  

However, now that everyone is working from home over VPN, that seems not to work.  Our laptops are domain joined so on power-up, the laptop user first logs into windows, then initiates a VPN connection to our network.  

1) How do remote laptop users get the token which allows them to access newly added groups?

2) Is there any danger of access tokens expiring during this pandemic and suddenly users cannot access any groups?

Thanks,
Mike