At first I was only using SSO, but then I ran into the problem that it only updates group membership when people log in. In the case of people not being re-elected, or otherwise losing the right to access a group, or gaining the right to access a group (and should receive email notifications for messages in the restricted group subforum), I need to add/remove them via the API.