API to dynamically register and tag from Panorama to Firewall

[Sec101]

I'm finding we can use the api to register IPs to Tags on panorama no problem.   I can view that they are registered on Panorama.   However, Panorama is not pushing these mappings to the managed firewalls.   I'm matching on name and I'm using the dynamic group in a policy on that firewall.    

What actually kicks panorama to push a registered IP to TAG  over to a managed firewall?  

[nikoolayy1]

I don't know if this will work but have test User-ID redistribution?

https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/panorama-overview/user-id-redistributi...

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/user-id/deploy-user-id-in-a-large-scale-ne...