Users or groups from subdomains can't be added to policies