A company with a large Active Directory (AD) of over 20,000 groups has user roles based on group membership in the directory. Up to 1,000 groups may…

For large Active Directory environments, it is a documented best practice to filter the groups synchronized to the firewall to reduce the load on the management plane and improve performance. An include list is the most direct and administratively simple method to specify exactly which of the 20,000+ groups are needed for security policies (up to 1,000). This approach precisely addresses the customer's requirements to use a subset of groups and reduce overhead without the complexity of custom LDAP filters or the unnecessary load of synchronizing all groups.

A. Custom LDAP filters are more complex to create and maintain than a simple include list, increasing administrative overhead.
B. Synchronizing all 20,000+ groups would create significant, unnecessary overhead on the firewall's management plane, which is the opposite of the desired outcome.
D. While the Cloud Identity Engine (CIE) is a modern architecture, configuring an include list is a more direct and fundamental solution to the specific problem of filtering groups.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide Version 11.0. Configure Group Mapping. "To optimize performance and avoid committing unnecessary information to the firewall, create an Include List to specify only the groups that you want to make available on the firewall."