I want to assign groups of ADs that are within an eDir branch, I had planned to do it in UA using resources and entitlements, but I have never done so. What would be the steps?