I am planning a Cloudpath ES 5 deployment. We're going to be using sponsored guest access. Our sponsors are spread out over several OUs, but we have AD distribution lists and security groups that contain the Sponsors. Can one use Active Directory Distribution lists or security groups instead of an OU to authenticate sponsors?