I would find it very helpful if we could create access groups comprised of Orion local accounts, AD individual accounts, and AD groups. Rights could then be controlled on that one group at a time and be applied to everything inside of it. This would really help simplify how we have access set up in Orion now.