If you just thought that migrating groups is not a problem since I only have one instance, then shame on you, but that is a topic for another day. Assuming you do have separate CMS’s for Development, Test, and Production, in an idea world you would set up your security in your development instance, test to make sure it works and them migrate those setting through test and into production. Unfortunately using an external authentication group prevents you migrating your groups. This is because when migrating an object between SAP BusinessObjects instance the Cluster Unique Identifier (CUID) is used. When using external groups you cannot migrate them you have to import them into each instance. This causes the same group to have a different CUID in each instance. This means that as far as SAP BusinessObjects is concerned they are not the same group.