An option to restrict user access, either by using a check box next to an imported AD account, only allowing imported AD accounts to be used or by only allowing selected AD OU's to be able to access the system. This is vital in areas such as educational establishment where you don't want students (or certain members of staff) to access.