Hi John, You can do thois through Policy > Authorization. Create the relevant conditions and apply them there.

When I get anything useful back from TAC I will comment here.

As I am having the exact same issue (not AD but LDAP external users) and migrated to ISE because ACS is not the way forward in Cisco's marketing strategy I added this thread into an already existing TAC case with all sorts of mishaps when trying to u...