This was an interesting one that came up a couple of days ago. Simple, but hope it stops someone pulling their hair out.

EV Provisioning Groups allow you to input a LDAP Query to target users using any AD attribute or a combination of attributes - very flexible solution.