AD Password hashes on UTM

Hello Community,

when utilizing Sophos SSL VPN with AD Syced Users and Group Backend Membership, how will an Active Directory User Password change affect functionality of the SSL VPN. Does the Client only authenticate agains the configured Domain Controllers or are the user password hashes synced to the UTM as well?

I want to make sure that a mass AD Password Policy Change does not break SSL VPN Setups.

Thanks