Confluence setup using a crowd (500 user licence) delegated authentication directory to Active Directory for authentication and authorisation.
A person with an account in Active Directory attempts to login to confluence for the first time. Crowd automatically imports the users account into the delegated directory. This eats up one of the 500 crowd user licences. This user is deemed never to be given membership of confluence-users or confluence-administrators and therefore is simply wasting a user licence.
To rectify this situation it would be very useful to have the option on a delegated directory not to auto-import users. i.e. adding users will be a manual step. This issue relies on the fact that you can selectively import user accounts manually from active directory (or other external sources). See issues CWD-910 and CWD-945.