Create an account definition and update the IT operating data mapping so that the "Groups can be inherited" option is selected for all ADSAccounts requiring group inheritance.
Please refer to the Administration Guide for Connecting to Active Directory
for complete steps on Setting Up Account Definitions
1. For the created Account Definition, select "Edit IT operating data" under "Tasks".
2. Click "Add" to add a new column mapping.
3. In the "Column" drop-down select "ADSAccount.IsGroupAccount".
4. If the group membership will be based on a business role, select "Primary business role" as the "Source".
This will update the "Groups can be inherited" field for ADSAccounts linked to Employees assigned the applicable role/org.