I would suggest to have a separate sync-group attribute and to support only user in sync-user attribute.