Does BCAAA use more resources when the ProxySG policy refers to nested Active Directory group names on IWA realms?