In order to use AD nested groups, do we need to add an external IDM group for every nested group?
specifically, our AD people have global groups (account groups, they say) with the user accounts, and the domain local groups (resource groups, they call them) have these global groups as members.
So, in order to grant the people on the domain local groups which have no direct user members, should we create both external groups in Idm? Both the global group and the domain local group?