Originally Posted by Lylirra (Source)

For those of you reporting issues promoting or demoting guild members to a rank that has the “Requires an Authenticator” permission enabled, I have a bit more information for you.

As noted in the main post, if a player attaches an Authenticator to his or her Battle.net account, it may take a few days before guild controls will recognize the Authenticator and allow that player’s characters to be moved to a protected guild rank. Since this feature is new with patch 4.0.1, though, this sort of “checking” has to occur globally—so it’ll be roughly 72 hours from the first time a character logs in after patching before it will be eligible for an Authenticator-required rank. This wait period will still apply even if a player has had an Authenticator attached to their account for months (or even years).

Apologies for the confusion!