As noted elsewhere, you sort of have to kick people off and make them reconnect (so that they pick up the config change you're making).
However, this presents issues, especially when using multi-factor (time based) authentication. Clearly, when they reconnect, they won't be able to use the same MFA code, so will have to re-enter it (which isn't always a nice experience in the VPN client).
OpenVPN AS solves this problem quite neatly, as it seems to let users re-authenticate without needing the MFA. The connection underneath does seem to completely close and reopen to do this, so I assume there's some server "magic" to allow recently disconnected people to reconnect.
If I had to guess, the server tracks who is connected at the time the process is restarted. It then allows those users to reconnect without needing authentication (just relying on the client certificate, which is unique for each user on the AS product). I'd also guess it only allows reconnecting without authentication for maybe a few seconds after disconnect because on occasion it asks for username/password/MFA after a restart, even though most times it doesn't. None of this is present in the community edition though.