Sure I totally support adding that. Semantics are a bit tricky though … something like:
groups:a,b,c
The tricky thing semantically is how to “remove” users from the groups if you sync SSO?
Perhaps couple an optional setting of “sso_allowed_groups” that lists the groups that are “settable” via sso. Then when you specify groups we can also ensure you are not mistakenly in any other sso_allowed_groups