To better comply with licensing and data restrictions. It would nice if the Active Directory sync could limit users synced not only by OU but by group membership and/or attribute value.