There are application setups (Jira, Confluence, etc.) that rely on Crowd for authentication and syncing group membership across Jira and Confluence for managing permissions.  If Crowd is currently pointed at a Microsoft AD site, and there is a need to switch to a different AD (ie.: Azure AD) one consequence of that switch is all users from Azure will be loaded into Crowd (which is beneficial in many ways), but also their Azure AD groups are loaded into Crowd.  This is not 100% needed because we can use Crowd-based groups for everything. Preventing the sync of external groups into Crowd will help with clutter, preventing errors, unexpected behaviors, and probably performance too.