I would like to provide user access based on their AD group membership. How do I set this up? We have autoenrollment enabled and users manually added are able to login through SSO. Hoping we can do this through AD group membership.