HostResolver.ResolveHost is called once per Setup() call, which itself normally runs once at construction. AppConfigOverride therefore reflects the resolver's state at the time it was last set, not a value re-evaluated per call to IsDeveloperMachine. Because Setup() is public virtual and HostResolver.ResolveHost can be invoked again by a derived or test client, this is not an unconditional, enforced one-time guarantee at the base-class level.
A true result requires both AD group membership and a non-empty AppSettings:ApplicationHost; AD membership alone is not sufficient (see security and authorization).
IsDeveloperMachine is itself virtual, so a derived environment client type may override this method with different logic; the base implementation described here is the one used by BaseEnvironmentClient and (unless overridden) SecureEnvironmentClient.