Feature Request: Add managed AD groups to job queues

[ShadowPeo]

The ability to add a user/device flag based on the job queue
The use case for this is that when someone reports that their device is lost, we want to lock the user and device accounts via GPO which we can already do, but it is manual; we simply want to put an automatic queue of “device lost” on the job, and have that then put the user and device either flagged into a group or directly into a group

[garysharp]

This seems reasonably achievable. Rather than adding/removing from user/device flags, it probably makes more sense to add Managed Groups to the Job Queue itself. If a job appears in a queue, it's managed group/s would either contain the Job User account or Device machine account.