When a directory in Crowd has read/write permissions, we can create users/groups in Crowd and have it synchronized to the external directory (e.g. AD).
When a group is created in Crowd, the sAMAccountName is not specified during group creation and causes AD to fill it up with a bunch of random characters. For example:
Assign the sAMAccountName attribute of the group object to the group name (cn).