When matching portal sub-settings with Active Directory groups, the first group encountered will be the one that is matched, as described below.
Sub settings will overrule the global settings for the users or computers to which they apply. Both users and computers can be in Active Directory groups or organizational units.
If a user or computer hits multiple sub settings, the first in listed order that includes the setting concerned wins. Furthermore, it is better to use a full OU path rather than a partial OU path.
For example:
When Scope is set to \CloudObjects\GROUP1, \CloudObjects\GROUP2, only devices from GROUP1 will be shown, because it comes first in the list.
When Scope is set to \CloudObjects\GROUP2, \CloudObjects\GROUP1, only devices from GROUP2 will be shown, because it comes first in the list.
If scope is set to the full OU path \CloudObjects\GROUP1\Workstations, \CloudObjects\GROUP2\Workstations, then devices from both groups will be shown.
If scope is set to Workstations, then devices from both groups will be shown.