Described in https://lists.internet2.edu/sympa/arc/comanage-users/2014-06/msg00001.html

Our enrollment flow includes group membership. The membership is functioning - i.e., upon approval the enrollee is a member of the group. Also, as we have automatic LDAP provisioning, the ou=person entry is created, and the person 'isMember' attribute does contain the group. However, the LDAP ou=group hasMember is not automatically updated.

This only seems to be a problem for provisioning at time of enrollment approval. If we manually provision, or if we change the group membership after enrollee approval, then the LDAP groups are properly updated.