After user account attributes are modified in Cisco NX-OS, when do changes to the user’s session attributes take effect?

In Cisco NX-OS, user session attributes, such as roles and permissions, are established when a user authenticates and a new session is created. Any modifications made to a user's account attributes (e.g., changing their role, password, or access rights) are not applied to any of their currently active sessions. The updated attributes are only read from the user database and applied when the user initiates a new login, thereby creating a new session. This ensures session stability and predictable behavior, preventing privilege changes during an active session.

A. immediately: Changes are not applied dynamically to active sessions; this would require a complex mechanism to update the session state in real-time, which is not how NX-OS operates.
B. at the scheduled time: Cisco NX-OS does not have a native scheduling feature for applying user account attribute modifications. Changes are event-driven by user login.
C. when the user logs out of a session: Logging out terminates the session. The changes cannot take effect on a session that no longer exists; they apply to the next session that is created. ---

1. Cisco Nexus 9000 Series NX-OS System Management Configuration Guide, Release 10.2(x)

Reference: Chapter: "Configuring User Accounts and RBAC", Section: "Information About User Accounts and Roles".

Content: The guide explicitly states, "Changes to a user account do not affect a user session that is in progress. The changes take effect the next time the user logs in." This directly supports that changes are applied upon the creation of a new session.

2. Cisco MDS 9000 Series NX-OS System Management Configuration Guide, Release 8.x

Reference: Chapter: "Configuring User Accounts and RBAC", Section: "Information About User Accounts and Roles".

Content: This document for the MDS platform, which also runs NX-OS, corroborates the behavior: "Note: Changes to a user account do not affect a user session that is in progress. The changes take effect the next time the user logs in." This confirms the principle is consistent across NX-OS platforms.