WORKAROUND:
The sudoers policy is able to use netgroups in Host_Alias specifications, and from the "Working with netgroups" section of the Authentication Services Admin Guide ... "With the Windows 2003 R2 schema, you can access netgroup data based on RFC 2307 stored in Active Directory through the Authentication Services name service module. "
This is the noted section from the Administration Guide:
https://support.oneidentity.com/technical-documents/authentication-services/4.1.6/administration-guide/11#TOPIC-950482