Assigning users to enterprise applications require AD P1 or P2. *sigh* At least, I think so... Need to test some more.